Cross-Site Scripting Vulnerability in PHPipam by PHPipam
CVE-2018-1000870

5.4MEDIUM

Key Information:

Vendor

PHPipam

Status
PHPipam
Vendor
CVE Published:
20 December 2018

What is CVE-2018-1000870?

PHPipam version 1.3.2 and earlier is affected by a cross-site scripting vulnerability located in /app/admin/users/print-user.php. This vulnerability can be exploited by an attacker who alters the theme parameter in user settings. When an admin views user information in the admin panel, malicious code can execute in the browser, potentially compromising user data and application integrity. This issue has been addressed and fixed in PHPipam version 1.4.

References

https://github.com/phpipam/phpipam/commit/552fbb0fc7ecb84...
x_refsource_MISC
https://github.com/phpipam/phpipam/issues/2326
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.