CVE-2018-11012: XSS
Published May 12, 2018
·Updated
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
Affected Software
1 affected component
Halo Halo=0.0.2
Event History
May 12, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-11012?
CVE-2018-11012 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
2
How do I fix CVE-2018-11012?
To fix CVE-2018-11012, ensure proper validation and sanitation of user inputs for the loginName and loginPwd parameters.
3
What are the implications of CVE-2018-11012?
The implications of CVE-2018-11012 include the risk of executing malicious scripts in a victim's browser, leading to sensitive data exposure.
4
Is CVE-2018-11012 affect only version 0.0.2 of Halo?
Yes, CVE-2018-11012 specifically affects version 0.0.2 of Halo.
5
Who is affected by CVE-2018-11012?
Users of the Halo application version 0.0.2 who utilize the affected login functionality are at risk from CVE-2018-11012.