Lucene search

MitreCVE-2018-1000512

HistoryJun 26, 2018 - 4:29 p.m.

CVE-2018-1000512

2018-06-2616:29:00

CWE-79

mitre

web.nvd.nist.gov

tooltipy

xss

cross site scripting

nvd

cve-2018-1000512

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.0%

JSON

Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.

Affected configurations

Nvd

Node

tooltipy_projecttooltipyMatch5.0wordpress

VendorProductVersionCPE
tooltipy_projecttooltipy5.0cpe:2.3:a:tooltipy_project:tooltipy:5.0:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
tooltipy_project	tooltipy	5.0	cpe:2.3:a:tooltipy_project:tooltipy:5.0:::::wordpress::

References

advisories.dxw.com/advisories/xss-in-tooltipy/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.0%

JSON

Related for CVE-2018-1000512