CVE-2018-25050 — Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting

Back Back to CVE browser

MEDIUM

Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting

Published Dec 28, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.

Affected products

Vendor Harvest Product Chosen Default
n/a
- Version
  1.8.0
  Status
  affected
  Constraints
  -
- Version
  1.8.1
  Status
  affected
  Constraints
  -
- Version
  1.8.2
  Status
  affected
  Constraints
  -
- Version
  1.8.3
  Status
  affected
  Constraints
  -
- Version
  1.8.4
  Status
  affected
  Constraints
  -
- Version
  1.8.5
  Status
  affected
  Constraints
  -
- Version
  1.8.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Harvest

Chosen

n/a

Version	Status	Constraints
1.8.0	affected	-
1.8.1	affected	-
1.8.2	affected	-
1.8.3	affected	-
1.8.4	affected	-
1.8.5	affected	-
1.8.6	affected	-

Remediation

No remediation recorded yet.

Metrics

0.60% 0.00599

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00599

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.60% (0.00599)	46.74th	v5 (v2026.06.15)
Jun 15, 2026	0.60% (0.00599)	43.82th	v5 (v2026.06.15)
Mar 17, 2025	0.07% (0.00074)	19.98th	v4 (v2025.03.14)
Dec 12, 2024	0.10% (0.00096)	42.00th	v3 (v2023.03.01)
Jun 9, 2024	0.10% (0.00098)	41.04th	v3 (v2023.03.01)
Apr 3, 2024	0.08% (0.00083)	34.09th	v3 (v2023.03.01)
Jan 30, 2024	0.07% (0.00073)	29.97th	v3 (v2023.03.01)
Jan 4, 2024	0.07% (0.00067)	27.87th	v3 (v2023.03.01)
Nov 28, 2023	0.06% (0.00060)	23.62th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.25th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Jan 7, 2023	1.02% (0.01018)	39.77th	v2 (v2022.01.01)
Dec 29, 2022	0.95% (0.00950)	31.57th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

https://github.com/advisories/GHSA-x5q4-m45m-fm94
Advisory
https://github.com/harvesthq/chosen/commit/77fd031d541e77510268d1041ed37798fdd1017e
patchThird Party Advisory
https://github.com/harvesthq/chosen/pull/2997
issue-trackingPatchThird Party Advisory
https://github.com/harvesthq/chosen/releases/tag/v1.8.7
patchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-25050
https://vuldb.com/?ctiid.216956
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216956
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-x5q4-m45m-fm94		Advisory
https://github.com/harvesthq/chosen/commit/77fd031d541e77510268d1041ed37798fdd1017e		patchThird Party Advisory
https://github.com/harvesthq/chosen/pull/2997		issue-trackingPatchThird Party Advisory
https://github.com/harvesthq/chosen/releases/tag/v1.8.7		patchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-25050
https://vuldb.com/?ctiid.216956		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216956		vdb-entrytechnical-descriptionThird Party Advisory