What is CVE-2018-15903?

CVE-2018-15903 is a medium-severity vulnerability in Claromentis, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-10-08.

How severe is CVE-2018-15903?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Claromentis

CVE-2018-15903

The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (49.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Claromentis — versions 8.2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2018-15903?: CVE-2018-15903 is a medium-severity vulnerability in Claromentis, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-10-08.
How severe is CVE-2018-15903?: Medium severity. CVSS v3 base score is 5.4 out of 10.