CVE-2018-14922

Опубликовано: 14 авг. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page.

Ссылки

http://packetstormsecurity.com/files/148836/Monstra-Dev-3.0.4-Cross-Site-Scripting.html
Third Party Advisory
VDB Entry
https://indiancybersecuritysolutions.com/cve-2018-14922-cross-site-scripting/
Third Party Advisory
https://www.exploit-db.com/exploits/45156/
Broken Link
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/148836/Monstra-Dev-3.0.4-Cross-Site-Scripting.html
Third Party Advisory
VDB Entry
https://indiancybersecuritysolutions.com/cve-2018-14922-cross-site-scripting/
Third Party Advisory
https://www.exploit-db.com/exploits/45156/
Broken Link
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.00343

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-wc6h-rjj3-rv8r