Cross-Site Scripting Vulnerability in b3log Solo by b3log
CVE-2018-16248

6.1MEDIUM

Key Information:

Vendor

B3log

Status
Solo
Vendor
CVE Published:
20 June 2019

What is CVE-2018-16248?

The b3log Solo 2.9.3 has a vulnerability that allows remote attackers to exploit an XSS flaw found in the 'Publish Articles' menu's Input page. By sending specially crafted admin-authenticated HTTP requests that contain malicious site names, attackers can inject arbitrary web scripts or HTML into the 'tag' JSON field. This poses a significant security risk, enabling potential malicious actions on the target's web application.

References

https://github.com/b3log/solo/issues/12489
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.