CVE-2016-1222: XSS Vulnerability in php-contact-form

Vulnerability Key Information Vulnerability ID: JVNDB-2016-000070 Vulnerability Description: php-contact-form, provided by Kobe Beauty Co., Ltd., contains a Cross-Site Scripting (XSS) vulnerability (CWE-79). Reporter: Hirota Kazuki, Mitsui Bussan Secure Directions, Inc. Assessment Authority: JPCERT/CC coordinated with the developer under the Information Security Early Warning Partners program. CVSS Severity Rating: - CVSS V3 Severity: 6.1 (Medium) [IPA Rating] - Attack Vector: Network - Attack Complexity: Low - Required Privileges: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None - CVSS V2 Severity: 4.3 (Medium) [IPA Rating] - Access Vector: Network - Access Complexity: Medium - Authentication: None - Confidentiality Impact: None 易 Integrity Impact: Partial - Availability Impact: None Affected Products: Versions of Kobe Beauty's php-contact-form prior to commit e7d094ca8ab15215c32d6fa04d17e8519c8d21cf. Impact: May allow execution of arbitrary scripts in users' web browsers. Solution: Update the software to the latest version provided by the developer. Vendor Information: - Kobe Beauty - GitHub: php-contact-form (Japanese) - Kobe Beauty Co., Ltd. Website (Japanese) CWE Vulnerability: - 1. Cross-Site Scripting (CWE-79) [IPA Assessment] CVE Number: CVE-2016-1222 References: - 1. JVN: JVN#85112513 - 2. National Vulnerability Database (NVD): CVE-2016-1222 Revision History: - [2016/05/24] - Webpage published - [2016/06/08] - Vendor Information: Content added - References: Content added Release Date: 2016/05/24 Initial Release Date: 2016/05/24 Last Updated Date: 2016/06/08

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2016-1222: XSS Vulnerability in php-contact-form