CVE-2018-10994: XSS
Published May 14, 2018
·Updated
js/views/messageview.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
Affected Software
1 affected component
Signal Signal-Desktop<1.10.1
Remediation
Event History
May 14, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-10994?
The severity of CVE-2018-10994 is medium.
2
How does CVE-2018-10994 affect Open Whisper Signal?
CVE-2018-10994 affects Open Whisper Signal (aka Signal-Desktop) before version 1.10.1.
3
What is the vulnerability description of CVE-2018-10994?
CVE-2018-10994 allows cross-site scripting (XSS) attacks via a URL in js/views/message_view.js.
4
What is the Common Weakness Enumeration (CWE) ID for CVE-2018-10994?
The CWE ID for CVE-2018-10994 is 79.
5
How do I fix CVE-2018-10994 in Open Whisper Signal?
To fix CVE-2018-10994, update Open Whisper Signal to version 1.10.1 or higher.