Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java, service/AvatarQueryService.java, and service/CommentQueryService.java.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
b3log Symphony 跨站脚本漏洞
Vulnerability Description
b3log Symphony（又名Sym）是一套开源的使用Java语言编写的现代社区平台，包括论坛、BBS、SNS和博客等。 b3log Symphony 2.2.0版本中存在跨站脚本漏洞。远程攻击者可通过向/settings/avatar发送特制的userAvatarURL参数利用该漏洞注入任意的Web脚本或HTML。
CVSS Information
N/A
Vulnerability Type
N/A