PT-2018-17087 · Dotclear · Dotclear

Trí Chim Trích · Published 2018-01-14 · Updated 2018-01-31 · CVE-2018-5690

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Dotclear version 2.12.1

Description: A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter, which is also known as the page limit number, in the admin/users.php file.

Recommendations: For Dotclear version 2.12.1, update to a version that fixes this issue to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-5690

Affected Products

Dotclear

References · 8

• https://cve.org/CVERecord?id=CVE-2018-5690 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5690 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5690 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5690 · Vendor Advisory
• https://hg.dotclear.org/dotclear/rev/3b0b868d58b0 · Vendor Advisory
• http://dev.dotclear.org/2.0/changeset/3b0b868d58b00a1b216e0dc13c461bb3550ed3da · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5690 · Note