Skip to content
Fencer Vulns
high 8.1

CVE-2017-8899 json

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the a…

published 2017-05-11 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17839

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The primary cause is the ability to upload an SVG document with a crafted attribute such an onload; however, full path disclosure is required for exploitation.

Exploit prediction

1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • zeroday.insecurity.zone http://zeroday.insecurity.zone/exploits/ipb_owned.txt referenced PoC, tagged "exploit" by a source, unverified
  • twitter.com https://twitter.com/insecurity/status/862154908895780864 referenced PoC, tagged "exploit" by a source, unverified
  • twitter.com https://twitter.com/sxcurity/status/862284967715381248 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.