GHSA-g32q-4fhf-cq72

ImpressCMS XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-13983

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	impresscms/impresscms	<= 1.3.10	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

ImpressCMS 1.3.10 has XSS via the PATH_INFO to `htdocs/install/index.php`, `htdocs/install/page_langselect.php`, or `htdocs/install/page_modcheck.php`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-13983 advisory
https://github.com/ImpressCMS/impresscms package
https://www.netsparker.com/web-applications-advisories/ns-18-033-cross-site-scripting-in-impresscms web
http://packetstormsecurity.com/files/150990/ImpressCMS-1.3.10-Cross-Site-Scripting.html web
http://seclists.org/fulldisclosure/2019/Jan/8 web