CVE-2018-16249: XSS
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16249?
CVE-2018-16249 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2018-16249?
To fix CVE-2018-16249, upgrade Symphony to version 3.3.0 or later to eliminate the XSS vulnerability.
Who is affected by CVE-2018-16249?
Users of Symphony versions prior to 3.3.0 are affected by CVE-2018-16249, particularly those with admin authentication.
What type of attack can CVE-2018-16249 allow?
CVE-2018-16249 can allow attackers to execute arbitrary web scripts or HTML through cross-site scripting (XSS).
Where does the vulnerability in CVE-2018-16249 occur?
The vulnerability in CVE-2018-16249 occurs in the 'Title' field under 'Post' when accessed through the /member/test/points URI.