CVE-2019-17522

No known exploitation. EPSS puts it in the 49th percentile. No fix published yet.

CVSS 3.14.8Medium EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2019-10-12Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Hotaru CMS 1.7.2 and who has administrator access.
Ask your software provider whether a supported fixed release is available; no official fixed version is currently known.
Until then, restrict administrator accounts to trusted staff, remove unused accounts, and review the site name setting for unexpected code.

May need vendor or contractor work

What it is

From the CVE record

A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.

In plain language

Written by AI from the record

Hotaru CMS 1.7.2 lets a trusted administrator plant harmful browser code in the site name setting, so most small businesses should address it during their next security review.

Stored XSS in Hotaru CMS v1.7.2 is triggered when attacker-controlled content in the SITE_NAME settings field is later rendered to an administrator.

If you're affected

Administrator session misuse
Website content tampering
Visitor trust damage

What is it

This is a flaw in the setting used to name a Hotaru CMS website. It can let a person with administrator access hide harmful instructions in that setting, like leaving a malicious note behind the front desk that runs when another administrator reads it.

Who is affected

This matters to you if you run Hotaru CMS 1.7.2. An attacker must already have high-level administrator access and must get another person to view the altered setting.

How urgent is it

Attackers would need administrator access and a second administrator to view the poisoned setting, which keeps this at an amber priority rather than an emergency. There is no record of confirmed active exploitation or publicly available attack code, but restrict administrator access and investigate unexpected setting changes.

What to do — in detail

Confirm whether any deployed Hotaru CMS instance is version 1.7.2, including staging systems exposed to staff or contractors.
Review administrator accounts, recent administrator logins, and the SITE_NAME value for script tags, event-handler attributes, encoded markup, or other unexpected HTML.
No vendor-fixed version or supported upgrade path is identified in the available findings. Contact the maintainer or your hosting provider for a supported remediation before applying unverified community changes.
If patching is delayed, limit administrator access to essential trusted users, remove inactive accounts, require strong unique passwords, and keep the settings page available only to authorized administrators.
Monitor administrator-account changes, edits to site settings, and browser or web-server alerts associated with the administration area. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2019-17522 is CWE-79 stored cross-site scripting in Hotaru CMS v1.7.2, involving the SITE_NAME field in the settings administration page. CVSS v3.1 is 4.8 (Medium): network attack vector, low complexity, high privileges required, user interaction required, and low confidentiality and integrity impact with changed scope. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.6% (48th percentile) with a flat trend. Press attention is rising, but that does not establish exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 1867 days, from the signal feeds we watch.

2024-11-21Record updated
2019-10-12Publishedweakness classified, att&ck mapped

Affected products

hotarucmsoss-project
- hotarucmsOn-premWeb & CMS Plugins / cms-core

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Scored 4.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact