PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6484 Inter Mediator CVE debrief

CVE-2017-6484 describes multiple cross-site scripting (XSS) issues in INTER-Mediator 5.5. The problem is in the PasswordReset/resetpassword.php flow, where insufficient filtration of the user-supplied c and cred parameters can let an attacker inject HTML or script that runs in a victim browser in the context of the vulnerable website.

Vendor
Inter Mediator
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-05
Original CVE updated
2026-05-13
Advisory published
2017-03-05
Advisory updated
2026-05-13

Who should care

Teams running INTER-Mediator 5.5, especially if the PasswordReset/resetpassword.php endpoint is reachable by untrusted users or exposed to the internet. Web application owners, developers maintaining password-reset flows, and defenders responsible for browser-side input handling should prioritize review.

Technical summary

NVD classifies the issue as CWE-79 (cross-site scripting) and assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability affects INTER-Mediator 5.5 and is tied to insufficient filtering of the c and cred parameters passed to PasswordReset/resetpassword.php. Because the browser executes attacker-controlled markup or script in the site context, impact includes script execution and potential session- or page-level abuse when a user follows the crafted flow.

Defensive priority

Medium priority. The issue is network-reachable and requires user interaction, but it can still affect victims who open the vulnerable reset-password flow. Prioritize remediation if the endpoint is public-facing or handles untrusted input.

Recommended defensive actions

  • Review the vendor guidance referenced in GitHub issue 772 and apply the available fix or mitigation for INTER-Mediator 5.5.
  • Restrict or temporarily remove exposure of PasswordReset/resetpassword.php if you cannot patch immediately.
  • Validate, sanitize, and contextually encode the c and cred parameters before any output reaches the browser.
  • Add server-side input validation to reject unexpected parameter formats and lengths.
  • Harden the application with defense-in-depth controls such as a restrictive Content Security Policy where feasible.
  • Test the password-reset flow after remediation to confirm the parameters are no longer reflected in executable form.

Evidence notes

This debrief is based only on the supplied official records and references. The source corpus identifies INTER-Mediator 5.5 as vulnerable, the affected path as INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php, and the weakness as CWE-79. The NVD entry provides CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N and references GitHub issue 772 as an exploit/vendor advisory. CVE publication date is 2017-03-05; the NVD record was last modified on 2026-05-13, which should not be treated as the issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-6484 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-6484

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-6484 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-6484

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.