CVE-2018-17830: XSS
Published Oct 1, 2018
·Updated
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args[ substring.
Affected Software
1 affected component
REDAXO REDAXO=5.6.2
Event History
Oct 1, 2018
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is CVE-2018-17830?
CVE-2018-17830 is a vulnerability in REDAXO 5.6.2 where the $args variable in addons/mediapool/pages/index.php is not effectively filtered, allowing an attacker to insert XSS payloads via a specific URL parameter.
2
How severe is CVE-2018-17830?
CVE-2018-17830 has a severity level of 5.4 (Medium).
3
What software version is affected by CVE-2018-17830?
REDAXO version 5.6.2 is affected by CVE-2018-17830.
4
How can the $args variable vulnerability in REDAXO 5.6.2 be exploited?
The vulnerability allows an attacker to insert XSS payloads via the 'index.php?page=mediapool/media&opener_input_field=&args[' parameter in REDAXO 5.6.2.