CVE-2018-18198: XSS

Published Oct 9, 2018

Updated

The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=[XSS] request.

Affected Software

1 affected component

REDAXO REDAXO=5.6.3

Remediation

Patch Available

https://github.com/redaxo/redaxo4/issues/422

Event History

Oct 9, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-18198?

CVE-2018-18198 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2018-18198?

To fix CVE-2018-18198, upgrade REDAXO to version 5.6.4 or later, where the issue has been addressed.

What does CVE-2018-18198 affect?

CVE-2018-18198 affects REDAXO version 5.6.3 specifically, allowing attackers to exploit unfiltered input.

What type of attack is possible with CVE-2018-18198?

CVE-2018-18198 allows an attacker to perform Cross-Site Scripting (XSS) attacks through unfiltered user input.

Can CVE-2018-18198 be mitigated without upgrading?

Mitigation without upgrading is not recommended, but temporary input sanitization could reduce immediate risk.