CVE-2018-10165: XSS

Published May 3, 2018

Updated

Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1Windows.

Affected Software

2 affected components

TP-Link Eap Controller Windows=2.5.4

TP-Link Eap Controller Windows=2.6.0

Event History

May 3, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10165?

CVE-2018-10165 is classified as a medium severity vulnerability due to the potential for stored cross-site scripting attacks.

How do I fix CVE-2018-10165?

To mitigate CVE-2018-10165, upgrade to the latest version of TP-Link EAP Controller beyond 2.6.0.

What kind of vulnerability is CVE-2018-10165?

CVE-2018-10165 is a stored cross-site scripting (XSS) vulnerability affecting authenticated users.

Who is affected by CVE-2018-10165?

CVE-2018-10165 affects users of the TP-Link EAP Controller versions 2.5.4 and 2.6.0 on Windows.

What is the potential impact of CVE-2018-10165?

The potential impact of CVE-2018-10165 includes the ability for authenticated attackers to inject arbitrary web scripts or HTML.