CVE-2018-19794

Опубликовано: 03 дек. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary web script or HTML via the code parameter.

Ссылки

https://bugs.internet2.edu/jira/browse/GRP-1838
Exploit
Mailing List
Vendor Advisory
https://lists.internet2.edu/sympa/arc/grouper-dev/2018-07/msg00005.html
Exploit
Mailing List
Patch
Vendor Advisory
https://spaces.at.internet2.edu/display/Grouper/v2.4+issues
Vendor Advisory
https://bugs.internet2.edu/jira/browse/GRP-1838
Exploit
Mailing List
Vendor Advisory
https://lists.internet2.edu/sympa/arc/grouper-dev/2018-07/msg00005.html
Exploit
Mailing List
Patch
Vendor Advisory
https://spaces.at.internet2.edu/display/Grouper/v2.4+issues
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:internet2:grouper:2.2:*:*:*:*:*:*:*

cpe:2.3:a:internet2:grouper:2.3:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00322

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-x4xr-9wg9-gx5c