CVE-2018-11352
Last modified
CVE-2018-11352 is a vulnerability of currently unknown severity. The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wallabag | Wallabag | >= 2.2.3, <= 2.3.2 |
References
- https://www.bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting/Exploit, Third Party Advisory
- https://www.bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-11352?
How severe is CVE-2018-11352?
How do I fix CVE-2018-11352?
Are you affected by CVE-2018-11352?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST