Cross-Site Scripting Vulnerability in Wallabag Application by Wallabag
CVE-2018-11352

4MEDIUM

Key Information:

Vendor

Wallabag

Status
Wallabag
Vendor
CVE Published:
21 September 2018

What is CVE-2018-11352?

A stored cross-site scripting (XSS) vulnerability exists in Wallabag versions 2.2.3 to 2.3.2, allowing attackers to inject malicious JavaScript payloads. This vulnerability manifests within the configuration page of the application, enabling an attacker to execute scripts when administrators visit the affected page. Exploitation requires prior authentication, which could lead to session hijacking and further compromise of sensitive administrative actions.

References

https://www.bishopfox.com/news/2018/09/wallabag-2-2-3-to-...
x_refsource_MISC

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.