exploitDog

CVE-2018-16248

Опубликовано: 20 июн. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.

Ссылки

https://github.com/b3log/solo/issues/12489
Exploit
Issue Tracking
Third Party Advisory
https://github.com/b3log/solo/issues/12489
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:b3log:solo:2.9.3:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00213

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-59wj-w49p-mx75

CVSS3: 6.1

github

больше 3 лет назад

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.

EPSS

Процентиль: 44%

0.00213

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79