CVE-2018-19089

2018-11-0719:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.7%

JSON

tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.

CPENameOperatorVersion
tiantieq1.1.0
tiantieq2.1.0
tiantieq2.0
tiantieq2.3
tiantieq2.2.0
tiantieq2.0.0
tiantieq1.2.0
tiantieq1.0.0

Name	Operator	Version
tianti	eq	1.1.0
tianti	eq	2.1.0
tianti	eq	2.0
tianti	eq	2.3
tianti	eq	2.2.0
tianti	eq	2.0.0
tianti	eq	1.2.0
tianti	eq	1.0.0

References

github.com/xujeff/tianti/issues/27