Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS01cGN2LW04dzItNjJtOc4AAUqV

Ajenti Cross-site Scripting Via Filename

Ajenti through v1.2.23.13 has a Cross-site Scripting (XSS) vulnerability via a filename that is mishandled in File Manager.

Permalink: https://github.com/advisories/GHSA-5pcv-m8w2-62m9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cGN2LW04dzItNjJtOc4AAUqV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 3 months ago

CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-5pcv-m8w2-62m9, CVE-2018-18548
References:

Blast Radius: 1.8

Affected Packages

pypi:ajenti

Dependent packages: 0
Dependent repositories: 2
Downloads: 24,451 last month
Affected Version Ranges: <= 1.2.23.13
No known fixed version
All affected versions: 0.99.7, 0.99.8, 0.99.11, 0.99.19, 0.99.20, 0.99.21, 0.99.22, 0.99.23, 0.99.24, 0.99.25, 0.99.26, 0.99.27, 0.99.28, 0.99.29, 0.99.30, 0.99.31, 0.99.32, 0.99.33, 0.99.34, 0.99.35, 0.99.36, 0.99.37, 0.99.38, 0.99.39, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.8, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.8, 1.1.9, 1.2.0, 1.2.1, 1.2.2-0.0, 1.2.2-0.1, 1.2.2-0.2, 1.2.2-0.3, 1.2.2-0.4, 1.2.2-0.5, 1.2.2-0.6, 1.2.2-0.7, 1.2.2-0.8, 1.2.2-0.9, 1.2.2-0.10, 1.2.2-1.0, 1.2.2-1.1, 1.2.2-1.2, 1.2.2-1.3, 1.2.2-1.4, 1.2.2-1.5, 1.2.2-1.6, 1.2.2-1.7, 1.2.2-1.8, 1.2.2-1.9, 1.2.2-1.10, 1.2.2-1.11, 1.2.2-1.12, 1.2.2-1.13, 1.2.2-1.14, 1.2.2-1.15, 1.2.2-1.16, 1.2.2-1.17, 1.2.2-1.18, 1.2.2-1.21, 1.2.2-2.0, 1.2.2-2.1, 1.2.2-2.2, 1.2.2-2.3, 1.2.2-2.4, 1.2.2-2.5, 1.2.2-2.6, 1.2.2-2.7, 1.2.2-2.8, 1.2.2-2.10, 1.2.2-2.11, 1.2.2-2.12, 1.2.2-2.13, 1.2.2-2.14, 1.2.2-2.16, 1.2.2-2.19, 1.2.2-2.23, 1.2.2-2.24, 1.2.2-3.2, 1.2.2-3.3, 1.2.2-3.4, 1.2.2-3.5, 1.2.2-3.6, 1.2.2-3.7, 1.2.2-3.8, 1.2.2-3.9, 1.2.2-3.13