Vulnerability Description
The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Balbooa | Gridbox | <= 2.4.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/148127/Joomla-2.4.0-Gridbox-Cross-Site-ScriExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jun/26ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/542066/100/0/threadedExploitThird Party AdvisoryVDB Entry
- https://vel.joomla.org/resolved/2155-gridbox-com-gridbox-multiple-vulnerabilitieVendor Advisory
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11690ExploitThird Party Advisory
- http://packetstormsecurity.com/files/148127/Joomla-2.4.0-Gridbox-Cross-Site-ScriExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jun/26ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/542066/100/0/threadedExploitThird Party AdvisoryVDB Entry
- https://vel.joomla.org/resolved/2155-gridbox-com-gridbox-multiple-vulnerabilitieVendor Advisory
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11690ExploitThird Party Advisory
FAQ
What is CVE-2018-11690?
CVE-2018-11690 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could explo...
How severe is CVE-2018-11690?
CVE-2018-11690 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-11690?
Check the references section above for vendor advisories and patch information. Affected products include: Balbooa Gridbox.