XSS in Avast Antivirus
CVE-2019-18653
A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (54.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Avast Antivirus — versions 19.3.2369
- Microsoft Windows
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-18653?
- CVE-2019-18653 is a medium-severity vulnerability in Avast Antivirus, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2019-11-01.
- How severe is CVE-2019-18653?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2019-18653 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.