CVE-2017-10886

moderate-risk

Published 2017-11-17

Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Do I need to act?

0.25% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Cs-Cart

Cs-Cart Multivendor

Affected Vendors

Cs-Cart

References (4)

Vendor Advisory http://tips.cs-cart.jp/fix-jvn-29602086.html

Third Party Advisory https://jvn.jp/en/jp/JVN29602086/index.html

Vendor Advisory http://tips.cs-cart.jp/fix-jvn-29602086.html

Third Party Advisory https://jvn.jp/en/jp/JVN29602086/index.html

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 24/34 · High