CVE-2018-1000528 - GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML

Back Back to CVE browser

MEDIUM

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML

Published Jun 26, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 46.36%

Description

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1921
Advisory
https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001
x_refsource_MISCPatchThird Party Advisory
https://github.com/gosa-project/gosa-core/issues/14
x_refsource_MISCThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00028.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://www.debian.org/security/2018/dsa-4239
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1921		Advisory
https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001		x_refsource_MISCPatchThird Party Advisory
https://github.com/gosa-project/gosa-core/issues/14		x_refsource_MISCThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00028.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://www.debian.org/security/2018/dsa-4239		vendor-advisoryx_refsource_DEBIANThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 26, 2018

Updated Aug 5, 2024

Reserved Jun 5, 2018

Link CVE-2018-1000528

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-1000528

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jun 26, 2018

Updated Aug 5, 2024

Link EUVD-2018-1921

GitHub

No data