5.4med
CVE-2018-7261
radiant vulnerable to Cross-site Scripting
Also known as GHSA-gp82-xr77-88f4
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
Exploit prediction (EPSS)
0.60% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | radiant | 1 listed versions | no fix listed |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securityfocus.com /bid/103080 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/541798/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-7261 · advisory
- web.archive.org /web/20200227130121/http://www.securityfocus.com/bid/103080 · web
- web.archive.org /web/20201209055741/http://www.securityfocus.com/archive/1/541798/100/0/threaded · web
Sources
- CVE List: CVE-2018-7261
- GitHub Advisory: GHSA-gp82-xr77-88f4
- NVD: CVE-2018-7261
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.