Vulnerability-Lookup

CVE-2018-1000842 (GCVE-0-2018-1000842)

Vulnerability from cvelistv5 – Published: 2018-12-20 15:00 – Updated: 2024-09-16 22:02

Summary

FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2348 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/asteinhauser/fat_free_crm/issues/1	x_refsource_MISC
https://github.com/asteinhauser/fat_free_crm/comm…	x_refsource_MISC
https://github.com/fatfreecrm/fat_free_crm/wiki/X…	x_refsource_MISC
https://groups.google.com/forum/#%21topic/fat-fre…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:47:57.338Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-20T15:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2018-11-27T13:54:33.479249",
          "DATE_REQUESTED": "2018-10-27T06:04:25",
          "ID": "CVE-2018-1000842",
          "REQUESTER": "security@fatfreecrm.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/asteinhauser/fat_free_crm/issues/1",
              "refsource": "MISC",
              "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
            },
            {
              "name": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa",
              "refsource": "MISC",
              "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
            },
            {
              "name": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29",
              "refsource": "MISC",
              "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000842",
    "datePublished": "2018-12-20T15:00:00.000Z",
    "dateReserved": "2018-12-20T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:02:28.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-1000842",
      "date": "2026-10-19",
      "epss": "0.01673",
      "percentile": "0.76489"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "16554B44-BB93-4020-814A-A6D72052733B",
                    "versionEndIncluding": "0.14.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "5CE3E475-AB71-4B62-B9EF-DF6C153443B2",
                    "versionEndIncluding": "0.15.1",
                    "versionStartIncluding": "0.15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "15C0B298-D903-4A4A-9532-3DDE0E881D72",
                    "versionEndIncluding": "0.16.3",
                    "versionStartIncluding": "0.16.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "06E6410E-AE97-490C-9960-616D12BCF66E",
                    "versionEndIncluding": "0.17.2",
                    "versionStartIncluding": "0.17.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:0.18.0:*:*:*:*:ruby:*:*",
                    "matchCriteriaId": "EE4EECAE-FB06-4FC2-B171-C1FBE53BD2C4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
          },
          {
            "lang": "es",
            "value": "FatFreeCRM, en versiones anteriores a la 0.14.1, desde la versi\u00f3n 0.15.0 hasta la 0.15.1, desde la 0.16.0 hasta la 0.16.3, desde la 0.17.0 hasta la 0.17.2, y en versiones 0.18.0, contiene una vulnerabilidad Cross Site Scripting (XSS) en el commit con ID 6d60bc8ed010c4eda05d6645c64849f415f68d65 que puede resultar en la ejecuci\u00f3n de JavaScript. El ataque parece ser explotable en los navegadores del usuario final cuando visiten la p\u00e1gina, desencadenando la ejecuci\u00f3n de una carga \u00fatil con contenido con JavaScript. La vulnerabilidad parece haber sido solucionada en las versiones 0.18.1, 0.17.3, 0.16.4, 0.15.2 y 0.14.2."
          }
        ],
        "id": "CVE-2018-1000842",
        "lastModified": "2024-11-21T03:40:28.557",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-12-20T15:29:01.953",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2018-1000842

Vulnerability from fkie_nvd - Published: 2018-12-20 15:29 - Updated: 2026-06-17 01:33

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa	Patch
cve@mitre.org	https://github.com/asteinhauser/fat_free_crm/issues/1	Third Party Advisory
cve@mitre.org	https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29	Patch, Third Party Advisory
cve@mitre.org	https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc
af854a3a-2127-422b-91ae-364da2661108	https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/asteinhauser/fat_free_crm/issues/1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc

Impacted products

Vendor	Product	Version
fatfreecrm	fatfreecrm	*
fatfreecrm	fatfreecrm	*
fatfreecrm	fatfreecrm	*
fatfreecrm	fatfreecrm	*
fatfreecrm	fatfreecrm	0.18.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "16554B44-BB93-4020-814A-A6D72052733B",
              "versionEndIncluding": "0.14.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "5CE3E475-AB71-4B62-B9EF-DF6C153443B2",
              "versionEndIncluding": "0.15.1",
              "versionStartIncluding": "0.15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "15C0B298-D903-4A4A-9532-3DDE0E881D72",
              "versionEndIncluding": "0.16.3",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "06E6410E-AE97-490C-9960-616D12BCF66E",
              "versionEndIncluding": "0.17.2",
              "versionStartIncluding": "0.17.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fatfreecrm:fatfreecrm:0.18.0:*:*:*:*:ruby:*:*",
              "matchCriteriaId": "EE4EECAE-FB06-4FC2-B171-C1FBE53BD2C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
    },
    {
      "lang": "es",
      "value": "FatFreeCRM, en versiones anteriores a la 0.14.1, desde la versi\u00f3n 0.15.0 hasta la 0.15.1, desde la 0.16.0 hasta la 0.16.3, desde la 0.17.0 hasta la 0.17.2, y en versiones 0.18.0, contiene una vulnerabilidad Cross Site Scripting (XSS) en el commit con ID 6d60bc8ed010c4eda05d6645c64849f415f68d65 que puede resultar en la ejecuci\u00f3n de JavaScript. El ataque parece ser explotable en los navegadores del usuario final cuando visiten la p\u00e1gina, desencadenando la ejecuci\u00f3n de una carga \u00fatil con contenido con JavaScript. La vulnerabilidad parece haber sido solucionada en las versiones 0.18.1, 0.17.3, 0.16.4, 0.15.2 y 0.14.2."
    }
  ],
  "id": "CVE-2018-1000842",
  "lastModified": "2026-06-17T01:33:09.623",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-12-20T15:29:01.953",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-J5RJ-G695-342R

Vulnerability from github – Published: 2018-12-20 22:01 – Updated: 2023-08-25 21:22

Summary

Fat Free CRM vulnerable to Cross-site Scripting

Details

FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, and ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "fat_free_crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "fat_free_crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0"
            },
            {
              "fixed": "0.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "fat_free_crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.16.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "fat_free_crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.0"
            },
            {
              "fixed": "0.17.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "fat_free_crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.18.0"
            },
            {
              "fixed": "0.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.18.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:42:09Z",
    "nvd_published_at": "2018-12-20T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "FatFreeCRM version `\u003c=0.14.1`, `\u003e=0.15.0 \u003c=0.15.1`, `\u003e=0.16.0 \u003c=0.16.3`, `\u003e=0.17.0 \u003c=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.",
  "id": "GHSA-j5rj-g695-342r",
  "modified": "2023-08-25T21:22:06Z",
  "published": "2018-12-20T22:01:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000842"
    },
    {
      "type": "WEB",
      "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/asteinhauser/fat_free_crm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2018-1000842.yml"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fat Free CRM vulnerable to Cross-site Scripting"
}

GSD-2018-1000842

Vulnerability from gsd - Updated: 2018-10-27 00:00

Details

Aliases

CVE-2018-1000842

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-1000842",
    "description": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.",
    "id": "GSD-2018-1000842"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "fat_free_crm",
            "purl": "pkg:gem/fat_free_crm"
          }
        }
      ],
      "aliases": [
        "CVE-2018-1000842",
        "GHSA-j5rj-g695-342r"
      ],
      "details": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0\n\u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit\n6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution.\nThis attack appear to be exploitable via Content with Javascript payload will be\nexecuted on end user browsers when they visit the page. This vulnerability appears\nto have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.\n",
      "id": "GSD-2018-1000842",
      "modified": "2018-10-27T00:00:00.000Z",
      "published": "2018-10-27T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.3,
          "type": "CVSS_V2"
        },
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "fat_free_crm gem XSS vulnerability via query parameter"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "DATE_ASSIGNED": "2018-11-27T13:54:33.479249",
        "DATE_REQUESTED": "2018-10-27T06:04:25",
        "ID": "CVE-2018-1000842",
        "REQUESTER": "security@fatfreecrm.com",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/asteinhauser/fat_free_crm/issues/1",
            "refsource": "MISC",
            "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
          },
          {
            "name": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa",
            "refsource": "MISC",
            "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
          },
          {
            "name": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29",
            "refsource": "MISC",
            "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
          },
          {
            "name": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc",
            "refsource": "MISC",
            "url": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2018-1000842",
      "cvss_v2": 4.3,
      "cvss_v3": 6.1,
      "date": "2018-10-27",
      "description": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0\n\u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit\n6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution.\nThis attack appear to be exploitable via Content with Javascript payload will be\nexecuted on end user browsers when they visit the page. This vulnerability appears\nto have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.\n",
      "gem": "fat_free_crm",
      "ghsa": "j5rj-g695-342r",
      "patched_versions": [
        "\u003e= 0.18.1",
        "~\u003e 0.17.3",
        "~\u003e 0.16.4",
        "~\u003e 0.15.2",
        "~\u003e 0.14.2"
      ],
      "title": "fat_free_crm gem XSS vulnerability via query parameter",
      "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.14.1||\u003e=0.15.0 \u003c=0.15.1||\u003e=0.16.0 \u003c=0.16.3||\u003e=0.17.0 \u003c=0.17.2||=0.18.0",
          "affected_versions": "All versions up to 0.14.1, all versions starting from 0.15.0 up to 0.15.1, all versions starting from 0.16.0 up to 0.16.3, all versions starting from 0.17.0 up to 0.17.2, version 0.18.0",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2021-09-09",
          "description": "fat_free_crm is vulnerable to XSS.",
          "fixed_versions": [
            "0.14.2",
            "0.15.2",
            "0.16.4",
            "0.17.3",
            "0.18.1"
          ],
          "identifier": "CVE-2018-1000842",
          "identifiers": [
            "CVE-2018-1000842"
          ],
          "not_impacted": "All versions after 0.14.1 before 0.15.0, all versions after 0.15.1 before 0.16.0, all versions after 0.16.3 before 0.17.0, all versions after 0.17.2 before 0.18.0, all versions after 0.18.0",
          "package_slug": "gem/fat_free_crm",
          "pubdate": "2018-12-20",
          "solution": "Upgrade to versions 0.14.2, 0.15.2, 0.16.4, 0.17.3, 0.18.1 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2018-1000842",
            "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc",
            "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29",
            "https://github.com/asteinhauser/fat_free_crm/issues/1",
            "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
          ],
          "uuid": "82acbc75-eaae-40c7-bc97-73c206b43d76"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.14.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.15.1",
                "versionStartIncluding": "0.15.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.16.3",
                "versionStartIncluding": "0.16.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fatfreecrm:fatfreecrm:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.17.2",
                "versionStartIncluding": "0.17.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fatfreecrm:fatfreecrm:0.18.0:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-1000842"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "FatFreeCRM version \u003c=0.14.1, \u003e=0.15.0 \u003c=0.15.1, \u003e=0.16.0 \u003c=0.16.3, \u003e=0.17.0 \u003c=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://groups.google.com/forum/#!topic/fat-free-crm-users/TxsdZXSe7Jc"
            },
            {
              "name": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29"
            },
            {
              "name": "https://github.com/asteinhauser/fat_free_crm/issues/1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/asteinhauser/fat_free_crm/issues/1"
            },
            {
              "name": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-09-09T12:10Z",
      "publishedDate": "2018-12-20T15:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2018-1000842 (GCVE-0-2018-1000842)

FKIE_CVE-2018-1000842

GHSA-J5RJ-G695-342R

GSD-2018-1000842

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour