CVE-2018-19836: XSS
Published Dec 3, 2018
·Updated
In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.
Affected Software
1 affected component
Metinfo Metinfo=6.1.3
Event History
Dec 3, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is CVE-2018-19836?
CVE-2018-19836 is a vulnerability in Metinfo 6.1.3 that allows setting arbitrary HTTP headers, including the Cookie header.
2
How severe is CVE-2018-19836?
CVE-2018-19836 has a severity level of medium (6.1).
3
How can CVE-2018-19836 be exploited?
CVE-2018-19836 can be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters.
4
What software versions are affected by CVE-2018-19836?
Metinfo 6.1.3 is affected by CVE-2018-19836.
5
Is there a fix available for CVE-2018-19836?
There is no information available about a fix for CVE-2018-19836.