Cross-Site Scripting Vulnerability in InstantCMS by InstantSoft
CVE-2018-14382

6.1MEDIUM

Key Information:

Vendor

Instantcms

Status
Instantcms
Vendor
CVE Published:
18 July 2018

What is CVE-2018-14382?

An identified cross-site scripting vulnerability exists in InstantCMS version 2.10.1 due to insufficient input validation in the /redirect?url= parameter. Attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, which may lead to unauthorized actions being performed on their behalf and result in the theft of sensitive information.

References

https://github.com/instantsoft/icms2/issues/892
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.