CVE-2017-5673 describes a stored Cross-Site Scripting (XSS) vulnerability in the Kunena extension for Joomla!, specifically versions 5.0.2 through 5.0.4. This flaw allows attackers to inject malicious JavaScript into forum message subjects, which is then executed when other users view the affected messages. The vulnerability has a CVSSv3 score of 6.1 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to limited confidentiality and integrity impacts. The affected files are primarily related to message display layouts within the Crypsis and Crypsisb3 templates. There is no evidence of active exploitation, nor are there known public exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention. The issue was resolved in Kunena version 5.0.5.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.0.2CPE matchmatch criteria | cpe:2.3:a:kunena:kunena:5.0.2:*:*:*:*:joomla\!:*:* | ||
5.0.3CPE matchmatch criteria | cpe:2.3:a:kunena:kunena:5.0.3:*:*:*:*:joomla\!:*:* | ||
5.0.4CPE matchmatch criteria | cpe:2.3:a:kunena:kunena:5.0.4:*:*:*:*:joomla\!:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.