CVE-2018-16248: XSS
b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.
Affected Software
Event History
Frequently Asked Questions
What vulnerability is identified by CVE-2018-16248?
CVE-2018-16248 is an XSS vulnerability in b3log Solo 2.9.3 that allows attackers to inject arbitrary web scripts or HTML via an admin-authenticated HTTP request.
What is the severity of CVE-2018-16248?
The severity of CVE-2018-16248 can be classified as high due to its potential to execute arbitrary scripts in a web application.
How can I fix CVE-2018-16248?
To fix CVE-2018-16248, upgrade b3log Solo to the latest version that addresses this vulnerability.
Who is affected by CVE-2018-16248?
Users of b3log Solo version 2.9.3 are affected by CVE-2018-16248.
What does CVE-2018-16248 allow an attacker to do?
CVE-2018-16248 allows an attacker to inject arbitrary web scripts or HTML in the 'tag' JSON field of the Input page under the 'Publish Articles' menu.