CVEvulnerability

CVE-2018-1000611

6.1 MEDIUM Published 2018-07-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.

Affected configurations

• openconext openconext engineblock (>= 5.7.0 <= 5.7.3)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References