TWiki 6.0.2 Cross Site Scripting

🗓️ 07 Jan 2019 00:00:00Reported by Jiawang ZhangType

packetstorm🔗 packetstormsecurity.com👁 113 Views

TWiki 6.0.2 Cross Site Scripting in bin/statistic

Reporter	Title	Published	Views	Family All 10
CNVD	TWiki bin/statistics cross-site scripting vulnerability	7 Jan 201900:00	–	cnvd
CVE	CVE-2018-20212	17 Mar 201920:30	–	cve
Cvelist	CVE-2018-20212	17 Mar 201920:30	–	cvelist
EUVD	EUVD-2018-12779	7 Oct 202500:30	–	euvd
NVD	CVE-2018-20212	21 Mar 201916:00	–	nvd
OpenVAS	TWiki < 6.1.0 XSS Vulnerability	7 Jan 201900:00	–	openvas
OSV	CVE-2018-20212	21 Mar 201916:00	–	osv
Prion	Cross site scripting	21 Mar 201916:00	–	prion
RedhatCVE	CVE-2018-20212	22 May 202508:12	–	redhatcve
UbuntuCve	CVE-2018-20212	21 Mar 201916:00	–	ubuntucve

`# bin/statistics in TWiki 6.0.2 allows XSS via the webs parameter(CVE-2018-20212)  
  
  
## Vulnerability Type  
Cross Site Scripting (XSS)  
  
  
## Vendor of Product:  
twiki  
  
  
## Affected Product Version  
twiki - 6.0.2  
  
  
## Affected Component  
twiki/bin/statistics  
  
  
## Attack Type  
Remote  
  
  
## Attack Vectors  
/twiki/bin/statistics?webs=<script>alert(1)</script>  
  
  
## Credit   
This vulnerability was discovered by Jiawang Zhang Coordination Center of China (CNCERT/CC)  
  
  
## Product Download  
http://twiki.org/cgi-bin/view/Codev/DownloadTWiki  
  
  
## References  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20212  
  
`

07 Jan 2019 00:00Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.00309