Loading
Generated remediation guidance and an executive summary. No account required.
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.
Use CWE-79, Invisioncommunity vendor hub and Invision Power Board product page to widen CVE-2017-8898 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2013-3725, CVE-2012-2226 and CVE-2014-4928 for nearby disclosures in the same product family.