XSS Vulnerability in b3log Solo by b3log
CVE-2018-16805

4.8MEDIUM

Key Information:

Vendor

B3log

Status
Solo
Vendor
CVE Published:
10 September 2018

What is CVE-2018-16805?

The b3log Solo 2.9.3 application is susceptible to Cross-Site Scripting (XSS) attacks via the Input page under the Publish Articles menu. An attacker can exploit this vulnerability by providing a malicious site name, which is then stored in the link JSON field. This allows for the injection of arbitrary web scripts or HTML, potentially compromising the integrity of the application and end-users.

References

https://github.com/b3log/solo/issues/12501
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.