PT-2018-10511 · Wallabag · Wallabag

Publicado 2018-09-21 · Atualizado 2022-05-14 · CVE-2018-11352

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wallabag application versions 2.2.3 through 2.3.2

Description The issue is related to a cross-site scripting (XSS) vulnerability stored within the configuration page, which enables the execution of a JavaScript payload each time an administrator visits the configuration page. This can be exploited with authentication to target administrators and steal their sessions.

Recommendations For Wallabag application versions 2.2.3 through 2.3.2, as a temporary workaround, consider restricting access to the configuration page until a patch is available. Avoid using the configuration page with administrative privileges until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11352

GHSA-GVCW-X64M-PFCJ

Produtos afetados

Wallabag

Referências · 6

• 🔥 https://bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting · Exploit
• https://github.com/wallabag/wallabag · Nota
• https://bishopfox.com/blog/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting · Nota
• https://osv.dev/vulnerability/CVE-2018-11352 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gvcw-x64m-pfcj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11352 · Nota de Segurança