CVE-2018-5249: XSS
Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the bancanLogin function in index.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5249?
CVE-2018-5249 is rated as a moderate severity cross-site scripting vulnerability that allows remote code injection.
How do I fix CVE-2018-5249?
To fix CVE-2018-5249, upgrade to Shaarli version 0.8.5 or 0.9.3 and above.
Who is affected by CVE-2018-5249?
CVE-2018-5249 affects Shaarli versions earlier than 0.8.5 and those in the 0.9.x range before 0.9.3.
What type of vulnerability is CVE-2018-5249?
CVE-2018-5249 is a cross-site scripting (XSS) vulnerability impacting the login form's username field.
Could CVE-2018-5249 lead to further attacks?
Yes, exploitation of CVE-2018-5249 could allow attackers to execute arbitrary scripts in the context of a user's browser session.