1. Home
  2. CVE Database
  3. CVE-2018-1000611
MEDIUM · 6.1

CVE-2018-1000611

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and lo...

Vulnerability Description

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.

CVSS Score

6.1

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
OpenconextOpenconext Engineblock>= 5.7.0, <= 5.7.3

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2018-1000611?

CVE-2018-1000611 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and lo...

How severe is CVE-2018-1000611?

CVE-2018-1000611 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-1000611?

Check the references section above for vendor advisories and patch information. Affected products include: Openconext Openconext Engineblock.