PT-2018-10511 · Wallabag · Wallabag

Published 2018-09-21 · Updated 2022-05-14 · CVE-2018-11352

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wallabag application versions 2.2.3 through 2.3.2

Description The issue is related to a cross-site scripting (XSS) vulnerability stored within the configuration page, which enables the execution of a JavaScript payload each time an administrator visits the configuration page. This can be exploited with authentication to target administrators and steal their sessions.

Recommendations For Wallabag application versions 2.2.3 through 2.3.2, as a temporary workaround, consider restricting access to the configuration page until a patch is available. Avoid using the configuration page with administrative privileges until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11352

GHSA-GVCW-X64M-PFCJ

Affected Products

Wallabag

References · 6

• 🔥 https://bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting · Exploit
• https://osv.dev/vulnerability/CVE-2018-11352 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gvcw-x64m-pfcj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11352 · Security Note
• https://github.com/wallabag/wallabag · Note
• https://bishopfox.com/blog/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting · Note