CVE-2018-16484

Опубликовано: 01 фев. 2019

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.

Ссылки

https://hackerone.com/reports/319794
Exploit
Third Party Advisory
https://hackerone.com/reports/319794
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:m-server_project:m-server:*:*:*:*:*:node.js:*:*

Версия до 1.4.2 (исключая)

EPSS

Процентиль: 37%

0.00162

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-gmxv-xf2q-6j8m