CVE-2018-15903: XSS
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15903?
CVE-2018-15903 has been classified as a low severity vulnerability due to the conditions required for exploitation.
How do I fix CVE-2018-15903?
To fix CVE-2018-15903, update the Discuss module to the latest version provided by Claromentis.
Who is affected by CVE-2018-15903?
CVE-2018-15903 affects users of Claromentis version 8.2.2 using the Discuss module.
What type of vulnerability is CVE-2018-15903?
CVE-2018-15903 is a stored Cross Site Scripting (XSS) vulnerability.
Can CVE-2018-15903 be exploited by low privilege users?
Yes, CVE-2018-15903 can be exploited by low privilege users to inject malicious JavaScript.