PT-2019-9648 · Unknown · Advanced Comment System

Rafael Pedrero · Publicado 2019-03-17 · Atualizado 2019-03-27 · CVE-2018-18845

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Comment System version 1.0

Description The issue allows a remote unauthenticated attacker to potentially exploit a reflected cross-site scripting vulnerability via the ACS path variable. This could lead to the supply of malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.

Recommendations For Advanced Comment System version 1.0, as the product is discontinued, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18845

Produtos afetados

Advanced Comment System

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Feb/46 · Exploit
• 🔥 http://packetstormsecurity.com/files/151799/Advanced-Comment-System-1.0-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18845 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18845 · Aviso do Fabricante