Ubuntu.comUB:CVE-2018-1999022CVE-2018-1999022
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
75.4%
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95)
vulnerability in HTML_QuickForm’s getSubmitValue method, HTML_QuickForm’s
validate method, HTML_QuickForm_hierselect’s _setOptions method,
HTML_QuickForm_element’s _findValue method, HTML_QuickForm_element’s
_prepareValue method. that can result in Possible information disclosure,
possible impact on data integrity and execution of arbitrary code. This
attack appear to be exploitable via A specially crafted query string could
be utilised, e.g.
http://www.example.com/admin/add_practice_type_id[1]=fubar’])%20OR%20die(%27OOK!%27);%20//&mode=live.
This vulnerability appears to have been fixed in 3.2.15.
References
blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/
civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform
launchpad.net/bugs/cve/CVE-2018-1999022
nvd.nist.gov/vuln/detail/CVE-2018-1999022
security-tracker.debian.org/tracker/CVE-2018-1999022
www.cve.org/CVERecord?id=CVE-2018-1999022
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
75.4%