Vulners
Lucene search
OpenConext-EngineBlock 5.7.3 Cross Site Scripting Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Update Atlassian Platform to 3.5.19 to fix CVE-2018-1000613, CVE-2019-17571 and other vulnerabilities | 3 Feb 202122:39 | – | atlassian |
 | CVE-2018-10006 | 30 Jun 202210:33 | – | cve |
| CVE-2018-1000611 | 9 Jul 201820:00 | – | cve |
 | CVE-2018-1000611 | 9 Jul 201820:00 | – | cvelist |
 | EUVD-2018-1948 | 7 Oct 202500:30 | – | euvd |
 | Vulnerabilities fixed in IBM Cognos Analytics | 25 Apr 202200:00 | – | ncsc |
 | CVE-2018-1000611 | 9 Jul 201820:29 | – | nvd |
 | OpenConext-EngineBlock 5.7.3 Cross Site Scripting | 13 Jul 201800:00 | – | packetstorm |
 | Cross site scripting | 9 Jul 201820:29 | – | prion |
 | CVE-2018-1000611 | 22 May 202502:34 | – | redhatcve |
10
XSS vulnerabilities were found in multiple pages that allows an attacker to
inject arbitrary web scripts.
The Twig PHP extension configuration was not sanitizing user input before
display it to the user.
Issues fixed in version 5.7.4 and 5.8.0. Git commit here:
https://github.com/OpenConext/OpenConext-engineblock/pull/566
PoC URLs:
https://engine.example.org/authentication/idp/help-discover?%22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E
https://engine.example.org/authentication/idp/single-sign-on?%22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E
CVE assigned: CVE-2018-1000611
Timeline:
- - - 2018-06-29: Notified SURFnet about the vulnerability
- - - 2018-07-04: Patch pull request created on Github
- - - 2018-07-04: CVE Requested
- - - 2018-07-05: Patch was merged on Github
- - - 2018-07-12: Announcing on Full Disclosure
# 0day.today [2018-07-13] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Jul 2018 00:00Current
EPSS0.0024