CVE-2018-18209

2018-10-1016:29:00

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.

CPENameOperatorVersion
dilicmseq2.2.0-rc.1
dilicmseq2.1.3
dilicmseq2.1.1
dilicmseq2.0
dilicmseq2.0Final
dilicmseq2.2.0-rc.2
dilicmseq2.3.1
dilicmseq2.1.2
dilicmseq2.1.0
dilicmseq2.4.0

Name	Operator	Version
dilicms	eq	2.2.0-rc.1
dilicms	eq	2.1.3
dilicms	eq	2.1.1
dilicms	eq	2.0
dilicms	eq	2.0Final
dilicms	eq	2.2.0-rc.2
dilicms	eq	2.3.1
dilicms	eq	2.1.2
dilicms	eq	2.1.0
dilicms	eq	2.4.0

References

github.com/chekun/DiliCMS/issues/59