PT-2018-14907 · Valine · Valine

Passer6Yo · Published 2018-11-15 · Updated 2020-08-24 · CVE-2018-19289

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Valine version 1.3.3

Description An issue in Valine allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

Recommendations For Valine version 1.3.3, consider disabling the ability to embed files, especially .pdf files, until a patch is available to prevent HTML injection and potential JavaScript execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-19289

GHSA-HHRP-QM88-XJR3

Affected Products

Valine

References · 7

• 🔥 https://github.com/xCss/Valine/issues/127 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19289 · Security Note
• https://osv.dev/vulnerability/GHSA-hhrp-qm88-xjr3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19289 · Vendor Advisory
• https://github.com/xCss/Valine/commit/32d4d5e68df804f0eabb1a2bebbbf9459e31c2b7 · Note
• https://github.com/xCss/Valine · Note
• https://github.com/advisories/GHSA-hhrp-qm88-xjr3 · Note