CVE-2018-25056

EPSS 0.08%
Published 28.12.2022 12:15:08
Last modified 21.11.2024 04:03:27
Source cna@vuldb.com
Teams watchlist Login
Open Login

A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Yola ≫ Yolapi Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.242

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cna@vuldb.com	3.5	2.1	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/yola/yolapi/commit/a0fe129055a99f429133a5c40cb13b44611ff796

Patch

Third Party Advisory

https://vuldb.com/?ctiid.216966

Third Party Advisory

https://vuldb.com/?id.216966

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-25056

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-25056

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-25056

EUVD