NVD Vulnerability Detail

CVE-2018-1000528

Summary	GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.
Publication Date	June 27, 2018, 1:29 a.m.
Registration Date	March 1, 2021, 6:40 p.m.
Last Update	Nov. 21, 2024, 12:40 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:gonicus:gosa:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001	Patch Third Party Advisory
2	https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001	Patch Third Party Advisory
3	https://github.com/gosa-project/gosa-core/issues/14	Third Party Advisory
4	https://github.com/gosa-project/gosa-core/issues/14	Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2018/07/msg00028.html	Mailing List Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2018/07/msg00028.html	Mailing List Third Party Advisory
7	https://www.debian.org/security/2018/dsa-4239	Third Party Advisory
8	https://www.debian.org/security/2018/dsa-4239	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

GONICUS GOsa におけるクロスサイトスクリプティングの脆弱性

Title	GONICUS GOsa におけるクロスサイトスクリプティングの脆弱性
Summary	GONICUS GOsa には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 4, 2018, midnight
Registration Date	Sept. 19, 2018, 3:39 p.m.
Last Update	Sept. 19, 2018, 3:39 p.m.

Affected System

Debian

Debian GNU/Linux

GOsa project

GOsa commit 56070d6289d47ba3f5918885954dcceb75606001 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-1000528	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000528
National Vulnerability Database (NVD)
2	CVE-2018-1000528	https://nvd.nist.gov/vuln/detail/CVE-2018-1000528

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4239	https://www.debian.org/security/2018/dsa-4239
GitHub
2	(see #14)	https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001
3	Server-Side Reflected XSS via POST to /gosa/password.php #14	https://github.com/gosa-project/gosa-core/issues/14

Change Log

No	Changed Details	Date of change
1	[2018年09月19日] 掲載	Sept. 19, 2018, 3:39 p.m.