CoreCVE
Back

MEDIUM

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request

Published Jun 20, 2019

Description

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 20, 2019
Updated Aug 5, 2024
Reserved Aug 30, 2018
Link CVE-2018-16248
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-16248
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-16248