CVE-2019-18860: [CVE-2019-18860] SQUID-2023:6 Cross Site Scripting in cachemgr.cgi
Published Mar 20, 2020
·Updated
Last updated 25 August 2025
Other sources
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
— Launchpad
Affected Software
9 affected componentsFixes available
Squid-Cache Squid<4.9
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
Canonical Ubuntu Linux=20.04
openSUSE Leap=15.1
debian/squid
4.13-10+deb11u34.13-10+deb11u65.7-2+deb12u55.7-2+deb12u46.13-2+deb13u17.4-1
Remediation
Patch Available
Patch Available
Event History
Mar 20, 2020
CVE Published
via MITRE·08:32 PM
Data Sourced
via MITRE·08:32 PM
Description
Data Sourced
via NVD·09:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:23 PM
Description
Nov 15, 2025
Data Sourced
via Ubuntu·12:45 AM
RemedyDescriptionSeverityAffected Software
Feb 20, 2026
Data Sourced
via Debian·10:43 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2019-18860.
2
What is the severity of CVE-2019-18860?
CVE-2019-18860 has a severity rating of medium (6.1).
3
Which software versions are affected by CVE-2019-18860?
Squid versions before 4.9 are affected by CVE-2019-18860.
4
How does CVE-2019-18860 affect Squid?
CVE-2019-18860 affects Squid by mishandling HTML in the host parameter to cachemgr.cgi.
5
How can I fix CVE-2019-18860?
To fix CVE-2019-18860, update Squid to version 4.9 or later.