CVE-2018-25054 - shred cilla Search search.jsp cross site scripting

Back Back to CVE browser

MEDIUM

shred cilla Search search.jsp cross site scripting

Published Dec 28, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp of the component Search Handler. The manipulation of the argument details leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is d345e6bc7798bd717a583ec7f545ca387819d5c7. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216960.

Affected products

Vendor Shred Product Cilla Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shred

Cilla

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/shred/cilla/commit/d345e6bc7798bd717a583ec7f545ca387819d5c7
patchThird Party Advisory
https://vuldb.com/?ctiid.216960
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.216960
vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://github.com/shred/cilla/commit/d345e6bc7798bd717a583ec7f545ca387819d5c7		patchThird Party Advisory
https://vuldb.com/?ctiid.216960		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.216960		vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory