Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).
References
| Link | Resource |
|---|---|
| https://docs.google.com/document/d/1ZG1qiwpECbVnv92yNckDn7yyuluKoC2_ON-eLhAY97Q/edit?usp=sharing | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/44612/ | Exploit Third Party Advisory VDB Entry |
| https://docs.google.com/document/d/1ZG1qiwpECbVnv92yNckDn7yyuluKoC2_ON-eLhAY97Q/edit?usp=sharing | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/44612/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.google.com/document/d/1ZG1qiwpECbVnv92yNckDn7yyuluKoC2_ON-eLhAY97Q/edit?usp=sharing - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/44612/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-04-12 15:29
Updated : 2024-11-21 04:15
NVD link : CVE-2018-9155
Mitre link : CVE-2018-9155
CVE.ORG link : CVE-2018-9155
JSON object : View
Products Affected
open-audit
- open-audit
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')