Unauthenticated Reflected XSS in OpenWrt Web Server
CVE-2018-19630

6.1MEDIUM

Key Information:

Vendor

Openwrt

Status
Lede
Openwrt
Vendor
CVE Published:
28 November 2018

What is CVE-2018-19630?

The uhttpd component in OpenWrt versions up to 18.06.1 and LEDE up to 17.01 is susceptible to unauthenticated reflected cross-site scripting (XSS) due to improper handling of user input via the URI. This vulnerability can be exploited by crafting a malicious URI that can execute arbitrary scripts in the context of the user’s browser. Attackers can use this flaw to potentially hijack user sessions or execute unwanted actions on behalf of the users.

References

https://bugs.openwrt.org/index.php?do=details&task_id=1974
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.