CVE-2017-20153

aerouk imageserve cross site scripting

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.12.6Low EPSS percentile47th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2022-12-30Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Ask your IT person or web host whether your imageserve installation includes the vendor’s security remediation for CVE-2017-20153.
Apply the vendor patch from commit 2ac3cd4f90b4df66874fab171376ca26868604c4; no fixed release version is published in the available information.
Until patched, restrict untrusted access to imageserve and ensure unusual web addresses are rejected or safely displayed.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.

In plain language

Written by AI from the record

If you use imageserve, address this flaw because it can put misleading content into a visitor’s browser; the concern is moderate and vendor remediation is available.

CVE-2017-20153 is a low-severity cross-site scripting flaw in imageserve where a crafted REQUEST_URI can be reflected into browser content.

If you're affected

Misleading content on your site
Visitor trust damage
Limited website-content tampering

What is it

A visitor can be tricked into opening a specially made web address that causes your site to show content chosen by an attacker in that visitor’s browser. It is like someone placing a convincing but unauthorized note inside a page from your business, which can mislead visitors and harm trust.

Who is affected

This matters to you if you use or run imageserve to serve images through a website or application. It is most relevant where untrusted people can reach the service and send specially made web addresses.

How urgent is it

A publicly available demonstration gives attackers a starting point for abusing this issue, so schedule remediation promptly. It is not listed in the government’s known-exploited-vulnerability catalog, and the attack is reported as difficult, which supports an amber rather than emergency response.

What to do — in detail

Confirm the deployed imageserve source or package revision and compare it with the vendor remediation commit 2ac3cd4f90b4df66874fab171376ca26868604c4. No fixed release versions or supported branches are published in the available findings, so use that commit as the remediation target and test the update in a staging environment before deployment.

The issue concerns handling of REQUEST_URI; if patching is delayed, place imageserve behind access controls where practical and configure the surrounding web stack or application to reject malformed or untrusted request paths rather than reflecting them into responses. Review web-server and application logs for suspicious requests containing script-like markup or heavily encoded path values, and investigate reports of unexpected content appearing in visitors’ browsers.

CISA has not assigned a KEV remediation due date for this CVE.

Technical context

CVE-2017-20153 is CWE-79 cross-site scripting with CVSS 3.1 score 2.6 (Low): AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N. The technical description identifies manipulation of REQUEST_URI as the attack path. One public GitHub proof of concept is known, but CISA KEV does not list the vulnerability and the findings do not confirm exploitation in the wild. EPSS is 0.6% (48th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS47th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 47th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Patch availablerecord updated
2022-12-30Publishedweakness classified, att&ck mapped

Affected products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Scored 2.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action