CVEvulnerability
CVE-2015-4699
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-08-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.
Affected configurations
• cloud4wi splash portal 5.9.6
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://seclists.org/fulldisclosure/2015/Dec/48 Mailing List, Third Party Advisory, VDB Entry
- http://www.quantumleap.it/cloud4wi-splash-portal-reflected-xss-vulnerability-cve-2015-4699/ Exploit, Third Party Advisory
- https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-Note Release Notes, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Dec/48 Mailing List, Third Party Advisory, VDB Entry
- http://www.quantumleap.it/cloud4wi-splash-portal-reflected-xss-vulnerability-cve-2015-4699/ Exploit, Third Party Advisory
- https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-Note Release Notes, Third Party Advisory