CVE-2018-12104: XSS
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI.
Other sources
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo prior to 0.9.0 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12104?
CVE-2018-12104 is considered a critical vulnerability due to its potential for enabling cross-site scripting attacks.
How do I fix CVE-2018-12104?
To fix CVE-2018-12104, upgrade Airbnb Knowledge Repo to version 0.9.0 or later.
What attacks can be executed through CVE-2018-12104?
CVE-2018-12104 allows attackers to inject arbitrary web scripts or HTML, leading to cross-site scripting attacks.
Which versions of Airbnb Knowledge Repo are affected by CVE-2018-12104?
CVE-2018-12104 affects Airbnb Knowledge Repo version 0.7.4 and earlier.
Is user data at risk due to CVE-2018-12104?
Yes, because CVE-2018-12104 can lead to unauthorized actions on behalf of users, compromising their data.