GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/board_form_update.php bo_content_head parameter.
References
| Link | Resource |
|---|---|
| https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-05e83ad5f4c0624ed6ff385aed1bf33b | Patch Third Party Advisory |
| https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172 | Patch Third Party Advisory |
| https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0 | Release Notes Third Party Advisory |
| https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-05e83ad5f4c0624ed6ff385aed1bf33b | Patch Third Party Advisory |
| https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172 | Patch Third Party Advisory |
| https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0 | Release Notes Third Party Advisory |
Configurations
History
21 Nov 2024, 03:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-05e83ad5f4c0624ed6ff385aed1bf33b - Patch, Third Party Advisory | |
| References | () https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172 - Patch, Third Party Advisory | |
| References | () https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0 - Release Notes, Third Party Advisory |
19 Sep 2024, 11:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sir
Sir gnuboard |
|
| CPE | cpe:2.3:a:sir:gnuboard:5.3.1.9:*:*:*:*:*:*:* |
Information
Published : 2019-07-23 17:15
Updated : 2024-11-21 03:56
NVD link : CVE-2018-18672
Mitre link : CVE-2018-18672
CVE.ORG link : CVE-2018-18672
JSON object : View
Products Affected
sir
- gnuboard
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')