| Package | Affected versions | Patched versions |
|---|---|---|
| symphony | = 2.2.0 |
b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free