exacttarget/fuelux · Security
fuelux vulnerable to Cross-Site Scripting in Pillbox feature
- GHSA ID
- GHSA-fwcw-5qw2-87mp
- CVE ID
- CVE-2016-1000235
- Severity
- high
- Published
- Updated
Description
Affected versions of fuelux contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.
Recommendation
Update to version 3.15.7 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')