Vulnerability CVE-2018-1000611

Vulnerability CVE-2018-1000611

Published: 2018-07-09

Description:

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	OpenConext-EngineBlock 5.7.3 Cross Site Scripting	Andrew Klaus	14.07.2018

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

References:

https://github.com/OpenConext/OpenConext-engineblock/pull/563/files

Copyright 2024, cxsecurity.com