CVE-2018-19794: XSS

Published Dec 3, 2018

Updated

Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary web script or HTML via the code parameter.

Affected Software

2 affected components

Internet2 Grouper=2.2

Internet2 Grouper=2.3

Remediation

Patch Available

https://lists.internet2.edu/sympa/arc/grouper-dev/2018-07/msg00005.html

Event History

Dec 3, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19794?

CVE-2018-19794 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2018-19794?

To fix CVE-2018-19794, upgrade to Internet2 Grouper version 2.4 or later, which resolves the cross-site scripting vulnerability.

What types of attacks can CVE-2018-19794 facilitate?

CVE-2018-19794 can facilitate cross-site scripting attacks, allowing attackers to inject arbitrary web scripts or HTML into the application.

Is my version of Internet2 Grouper affected by CVE-2018-19794?

Yes, Internet2 Grouper versions 2.2 and 2.3 are affected by CVE-2018-19794.

What is the impact of exploiting CVE-2018-19794?

Exploiting CVE-2018-19794 can lead to unauthorized access to user sessions and sensitive information through injected scripts.