{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-01-05T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-05T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shaarli/Shaarli/pull/1046"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-5249", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/shaarli/Shaarli/releases/tag/v0.8.5", "refsource": "CONFIRM", "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"}, {"name": "https://github.com/shaarli/Shaarli/pull/1046", "refsource": "CONFIRM", "url": "https://github.com/shaarli/Shaarli/pull/1046"}, {"name": "https://github.com/shaarli/Shaarli/releases/tag/v0.9.3", "refsource": "CONFIRM", "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:33:44.318Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shaarli/Shaarli/pull/1046"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-5249", "datePublished": "2018-01-05T20:00:00", "dateReserved": "2018-01-05T00:00:00", "dateUpdated": "2024-08-05T05:33:44.318Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*", "matchCriteriaId": "A15BA1B9-CB9B-4E2C-B8BC-F056451DC57F", "versionEndExcluding": "0.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF58258C-9FE8-4363-939F-E08387AE1F22", "versionEndExcluding": "0.9.3", "versionStartIncluding": "0.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php)."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en Shaarli, en versiones anteriores a la 0.8.5 y las versiones 0.9.x anteriores a la 0.9.3 permite que atacantes remotos inyecten c\u00f3digo arbitrario mediante el campo username del formulario de inicio de sesi\u00f3n (tambi\u00e9n conocido como el par\u00e1metro login en la funci\u00f3n ban_canLogin en index.php)."}], "id": "CVE-2018-5249", "lastModified": "2018-01-17T14:50:28.870", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-05T20:29:00.220", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/shaarli/Shaarli/pull/1046"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}