CVE-2018-8069: XSS

Published Mar 12, 2018

Updated

QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.

Affected Software

1 affected component

QCMS QCMS=3.0

Event History

Mar 12, 2018

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Data Sourced

via NVD·05:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs network access to the QCMS instance, valid low-privileged credentials, and a victim who will interact with the crafted content or request. The CVSS vector indicates user interaction is required.

How can I check for exposure or exploitation attempts?

The affected input is the webname parameter processed by /backend/system.html in QCMS version 3.0. Reviewing requests and application logs for unexpected script-like values in this parameter can help identify attempted exploitation.

CVE-2018-8069: XSS

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

How can I check for exposure or exploitation attempts?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

How can I check for exposure or exploitation attempts?