CVE-2018-1000855

Published: Dec 20, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.

Affected (1)

Products: Basecamp: Easymon

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Basecamp Easymon	Up to 1.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/basecamp/easymon/issues/26

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/basecamp/easymon/pull/25

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/basecamp/easymon/issues/26

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/basecamp/easymon/pull/25

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.