PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5961 Ionizecms CVE debrief

CVE-2017-5961 describes a browser-based cross-site scripting issue in Ionize through 1.0.8. The vulnerable code path accepts user-supplied data in the "path" HTTP GET parameter for the Codemirror dialog endpoint and does not filter it sufficiently, allowing an attacker to run arbitrary HTML and script in the context of the vulnerable site. The CVSS v3.0 vector reflects network reachability, low attack complexity, no privileges required, and user interaction.

Vendor
Ionizecms
Product
CVE-2017-5961
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-12
Original CVE updated
2026-05-13
Advisory published
2017-02-12
Advisory updated
2026-05-13

Who should care

Administrators and developers running Ionize instances at or below 1.0.8, especially anyone exposing the admin theme/Codemirror dialog endpoint to authenticated users. Security teams should also care because the impact is browser-side code execution in the site context, which can enable session theft, page tampering, or phishing inside the application.

Technical summary

NVD maps the flaw to CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue is tied to insufficient filtration of the "path" GET parameter passed to "ionize-master/themes/admin/javascript/tinymce/jscripts/tiny_mce/plugins/codemirror/dialog.php". Because the payload is reflected or otherwise rendered into a browser context without proper escaping, attacker-controlled HTML/JavaScript can execute with the origin of the vulnerable website. NVD records the affected CPE as ionizecms:ionize versions through and including 1.0.8 and rates the issue CVSS 3.0 6.1/Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Defensive priority

Medium. This is not a KEV-listed issue in the supplied corpus, but it is a network-reachable XSS with user interaction required and site-origin impact, so remediation should be prioritized for any exposed or actively used Ionize deployment.

Recommended defensive actions

  • Upgrade or replace Ionize instances affected through version 1.0.8, using vendor guidance and project references where available.
  • Review the Codemirror dialog endpoint and any similar admin-theme handlers for unescaped reflection of GET parameters.
  • Apply strict server-side output encoding and input validation for the "path" parameter and any related request data.
  • Limit access to admin interfaces with authentication, network restrictions, and least privilege to reduce exposure.
  • If compromise is suspected, invalidate user sessions and review logs for suspicious requests to the dialog.php endpoint.
  • Add regression tests or security checks that verify HTML/JavaScript metacharacters are safely encoded in rendered responses.

Evidence notes

The supplied corpus identifies the flaw as insufficient filtration of the "path" GET parameter in the Codemirror dialog endpoint and classifies it as CWE-79. NVD lists the vulnerable Ionize CPE as versions through and including 1.0.8 and provides the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. References supplied in the record include the official CVE/NVD entries and a GitHub issue marked as Exploit, Patch, Vendor Advisory, supporting the existence of a vendor-tracked remediation path without asserting a specific fixed version beyond the corpus.

Official resources

CVE published by the official record on 2017-02-12T04:59:00.207Z. The NVD record was later modified on 2026-05-13T00:24:29.033Z; that later modification date is not the vulnerability discovery date.