Security readout for executives and security teams
Plain-English summary
CVE-2017-20185 is a cross-site scripting issue in unsupported Fuzzy SWMP. A crafted theme value sent to swmp.php can make the application run attacker-controlled script in a user's browser. CVSS rates it medium, and public exploit details exist, but the bundle does not show CISA KEV listing or confirmed active exploitation.
Executive priority
Prioritize remediation for any internet-reachable or shared Fuzzy SWMP deployment. The business risk is moderate: browser-side compromise and trust abuse are plausible, but the scored impact is limited and authenticated access appears required.
Technical view
The issue is CWE-79 in Fuzzy SWMP's swmp.php GET Parameter Handler. Manipulating the theme argument leads to XSS. The CVSS v2 vector is AV:N/AC:L/Au:S/C:N/I:P/A:N, indicating remote network reachability, low complexity, authenticated access, partial integrity impact, and no scored confidentiality or availability impact.
Likely exposure
Exposure is likely limited to organizations still running unsupported Fuzzy SWMP, especially where swmp.php is reachable by authenticated users. Affected version details are unavailable because the project used rolling releases, so inventory and code-level verification matter more than version matching.
Exploitation context
The source bundle states the exploit has been publicly disclosed and may be used. It does not provide KEV status or another cited confirmation of active exploitation. Treat it as publicly known but not source-confirmed as actively exploited in the wild.
Researcher notes
Version data is incomplete, and the product was unsupported when assigned. The strongest identifiers are the affected file swmp.php, the theme GET argument, CWE-79, VulDB VDB-230669, and patch commit 792bcab637cb8c3bd251d8fc8771512c5329a93e.
Mitigation direction
- Apply patch commit 792bcab637cb8c3bd251d8fc8771512c5329a93e if still running SWMP.
- Prefer retiring or replacing unsupported Fuzzy SWMP deployments.
- Restrict access to SWMP to trusted users and networks where feasible.
- Review maintainer guidance and project history before relying on version labels.
- Add input/output handling controls for theme-like user-controlled parameters.
Validation and detection
- Inventory systems for Fuzzy SWMP and reachable swmp.php endpoints.
- Verify whether patch 792bcab637cb8c3bd251d8fc8771512c5329a93e is present.
- Review handling of the theme GET parameter for proper neutralization.
- Check web logs for unusual theme parameter activity.
- Confirm compensating access controls around any remaining SWMP instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-20185 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
4MediumVector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.230669CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.230669CVE reference · signature, permissions-required
- https://github.com/fuzzymannerz/swmp/pull/12CVE reference · exploit, issue-tracking
- https://github.com/fuzzymannerz/swmp/commit/792bcab637cb8c3bd251d8fc8771512c5329a93eCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.