CVE-2019-16890: XSS
Published Sep 25, 2019
·Updated
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.
Affected Software
1 affected component
Halo Halo=1.1.0
Remediation
Patch Available
Event History
Sep 25, 2019
CVE Published
via MITRE·08:17 PM
Data Sourced
via MITRE·08:17 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16890?
CVE-2019-16890 has a medium severity rating due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2019-16890?
To fix CVE-2019-16890, sanitize and validate user input for the authorUrl parameter before processing it.
3
What software is affected by CVE-2019-16890?
CVE-2019-16890 specifically affects Halo version 1.1.0.
4
What type of vulnerability is CVE-2019-16890?
CVE-2019-16890 is classified as a cross-site scripting (XSS) vulnerability.
5
Can CVE-2019-16890 be exploited remotely?
Yes, CVE-2019-16890 can be exploited remotely if an attacker can send crafted JSON data to the affected API.