Lucene search

[email protected]CVE-2018-10125

HistoryMar 16, 2020 - 3:15 p.m.

CVE-2018-10125

2020-03-1615:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-10125

contao

xss

system log

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.9%

JSON

Contao before 4.5.7 has XSS in the system log.

Affected configurations

NVD

Node

contaocontaoRange3.0.0–3.5.33

contaocontaoRange4.4.0–4.4.16

contaocontaoRange4.5.0–4.5.6

contaocontaoMatch4.0.0-

contaocontaoMatch4.1.0-

contaocontaoMatch4.2.0-

contaocontaoMatch4.3.0-

CPENameOperatorVersion
contao:contaocontaole3.5.33
contao:contaocontaole4.4.16
contao:contaocontaole4.5.6
contao:contaocontaoeq4.0.0
contao:contaocontaoeq4.1.0
contao:contaocontaoeq4.2.0
contao:contaocontaoeq4.3.0

CPE	Name	Operator	Version
contao:contao	contao	le	3.5.33
contao:contao	contao	le	4.4.16
contao:contao	contao	le	4.5.6
contao:contao	contao	eq	4.0.0
contao:contao	contao	eq	4.1.0
contao:contao	contao	eq	4.2.0
contao:contao	contao	eq	4.3.0