CVE-2018-5249

Опубликовано: 05 янв. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).

Ссылки

https://github.com/shaarli/Shaarli/pull/1046
Release Notes
Third Party Advisory
https://github.com/shaarli/Shaarli/releases/tag/v0.8.5
Third Party Advisory
https://github.com/shaarli/Shaarli/releases/tag/v0.9.3
Release Notes
Third Party Advisory
https://github.com/shaarli/Shaarli/pull/1046
Release Notes
Third Party Advisory
https://github.com/shaarli/Shaarli/releases/tag/v0.8.5
Third Party Advisory
https://github.com/shaarli/Shaarli/releases/tag/v0.9.3
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*

Версия до 0.8.5 (исключая)

Конфигурация 2

cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*

Версия от 0.9.0 (включая) до 0.9.3 (исключая)

EPSS

Процентиль: 54%

0.0031

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2018-5249

CVSS3: 6.1

ubuntu

около 8 лет назад

CVE-2018-5249

CVSS3: 6.1

debian

около 8 лет назад

Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0 ...

GHSA-43f8-j7wq-qhwm

CVSS3: 6.1

github

больше 3 лет назад

EPSS

Процентиль: 54%

0.0031

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79