CVE-2018-19922

Опубликовано: 06 дек. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.

Ссылки

https://github.com/logern5/c1000a_xss/blob/master/README.md
Exploit
Third Party Advisory
https://github.com/logern5/c1000a_xss/blob/master/README.md
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:actiontec:c1000a_firmware:*:*:*:*:*:*:*:*

Версия до cac004-31.30l.95 (включая)

cpe:2.3:h:actiontec:c1000a:-:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00223

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-cfhw-hg24-gjxm