CVE-2018-19089

tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.
References
Link Resource
https://github.com/xujeff/tianti/issues/27 Exploit Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:tianti_project:tianti:2.3:*:*:*:*:*:*:*

Information

Published : 2018-11-07 11:29

Updated : 2018-12-11 08:29


NVD link : CVE-2018-19089

Mitre link : CVE-2018-19089


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

tianti_project

  • tianti