Lucene search

K
cve[email protected]CVE-2018-25086
HistoryJun 01, 2023 - 7:15 a.m.

CVE-2018-25086

2023-06-0107:15:08
CWE-79
web.nvd.nist.gov
12
cve-2018-25086
sea75300 fanpress cm
template preview
cross-site scripting
remote attack
upgrade recommended

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.6%

A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230235.

Affected configurations

Vulners
NVD
Node
sea75300fanpress_cmMatch3.6.0
OR
sea75300fanpress_cmMatch3.6.1
OR
sea75300fanpress_cmMatch3.6.2
OR
sea75300fanpress_cmMatch3.6.3

CNA Affected

[
  {
    "vendor": "sea75300",
    "product": "FanPress CM",
    "versions": [
      {
        "version": "3.6.0",
        "status": "affected"
      },
      {
        "version": "3.6.1",
        "status": "affected"
      },
      {
        "version": "3.6.2",
        "status": "affected"
      },
      {
        "version": "3.6.3",
        "status": "affected"
      }
    ],
    "modules": [
      "Template Preview"
    ]
  }
]

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.6%

Related for CVE-2018-25086