Security readout for executives and security teams
Plain-English summary
MetInfo through 5.3.17 is reported to allow stored cross-site scripting through HTML Edit Mode. Malicious content could be saved in the CMS and later run in another user’s browser. The source bundle does not provide CVSS, affected CPEs, exploit details, or a confirmed fix.
Executive priority
Handle as a moderate-priority CMS risk. It is not listed in KEV and lacks severity scoring, but stored XSS can damage user trust, expose sessions, or support phishing if vulnerable CMS content is reachable.
Technical view
The CVE describes stored XSS in MetInfo through version 5.3.17 via HTML Edit Mode. The available record does not identify a parameter, endpoint, required privileges, payload format, or sanitization failure details. Treat this as a CMS content-storage validation issue until vendor evidence confirms scope.
Likely exposure
Exposure is most likely limited to organizations running MetInfo through 5.3.17 with HTML Edit Mode available. The provided sources do not clarify whether exploitation requires authenticated CMS access, administrator rights, or a specific content workflow.
Exploitation context
CISA KEV is false, and the provided sources do not claim active exploitation. Stored XSS can still matter because it persists in content and may affect later visitors or CMS users, depending on where the saved content renders.
Researcher notes
Evidence is sparse: the CVE description and one external reference identify MetInfo through 5.3.17 and HTML Edit Mode, but no CVSS, CWE, CPE, exploit status, affected endpoint, role requirement, or patch reference is provided.
Mitigation direction
- Inventory MetInfo deployments and confirm whether versions are through 5.3.17.
- Check MetInfo vendor guidance for a fixed release or official mitigation.
- Restrict HTML Edit Mode access to trusted CMS users only.
- Review stored CMS content for unexpected scripts or unsafe HTML.
- Apply a vendor-confirmed upgrade or configuration change when identified.
Validation and detection
- Confirm the running MetInfo version from application administration or deployment records.
- Identify whether HTML Edit Mode is enabled or used in content workflows.
- Review public and administrative pages that render stored HTML content.
- Check CMS logs for unusual content edits around sensitive pages.
- Document uncertainty where sources do not define affected components or privileges.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11716 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://lncken.cn/?p=339CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.