CVE-2018-14849 - Vulnerability Details - OpenCVE

Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tiki	Tikiwiki Cms\/groupware

Configuration 1 [-]

OR	cpe:2.3:a:tiki:tikiwiki_cms\/groupware::::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware::::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware::::::::

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2018/08/02/1
http://www.openwall.com/lists/oss-security/2018/08/02/2
https://sourceforge.net/p/tikiwiki/code/66809

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-08-13T17:00:00

Updated: 2024-08-05T09:38:14.078Z

Reserved: 2018-08-02T00:00:00

Link: CVE-2018-14849

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-08-13T17:29:01.203

Modified: 2024-11-21T03:49:54.933

Link: CVE-2018-14849

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-08-02T00:00:00", "descriptions": [{"lang": "en", "value": "Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-13T16:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20180802 Stored XSS vulnerabilities in Tiki <= 18.1", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/1"}, {"name": "[oss-security] 20180802 Re: Stored XSS vulnerabilities in Tiki <= 18.1", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://sourceforge.net/p/tikiwiki/code/66809"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-14849", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20180802 Stored XSS vulnerabilities in Tiki <= 18.1", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2018/08/02/1"}, {"name": "[oss-security] 20180802 Re: Stored XSS vulnerabilities in Tiki <= 18.1", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2018/08/02/2"}, {"name": "https://sourceforge.net/p/tikiwiki/code/66809", "refsource": "CONFIRM", "url": "https://sourceforge.net/p/tikiwiki/code/66809"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T09:38:14.078Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20180802 Stored XSS vulnerabilities in Tiki <= 18.1", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/1"}, {"name": "[oss-security] 20180802 Re: Stored XSS vulnerabilities in Tiki <= 18.1", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://sourceforge.net/p/tikiwiki/code/66809"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-14849", "datePublished": "2018-08-13T17:00:00", "dateReserved": "2018-08-02T00:00:00", "dateUpdated": "2024-08-05T09:38:14.078Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4E9A971-531E-43D6-AB49-88D1F393A74A", "versionEndExcluding": "12.14", "versionStartIncluding": "12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C2A34D3-6BA8-4E28-850C-DBE573F75BA5", "versionEndExcluding": "15.7", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADBF95E0-093F-4B48-A8D5-ED1244C25B85", "versionEndExcluding": "18.2", "versionStartIncluding": "18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php."}, {"lang": "es", "value": "Tiki en versiones anteriores a la 18.2, 15.7 y 12.14 tiene Cross-Site Scripting (XSS) mediante los atributos link relacionados con lib/core/WikiParser/OutputLink.php y lib/parser/parserlib.php."}], "id": "CVE-2018-14849", "lastModified": "2024-11-21T03:49:54.933", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-13T17:29:01.203", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/1"}, {"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/2"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://sourceforge.net/p/tikiwiki/code/66809"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2018/08/02/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://sourceforge.net/p/tikiwiki/code/66809"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}