CVE-2018-1000154

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-1000154

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000154.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-1000154

Published

2018-04-05T13:29:00.950Z

Modified

2026-04-10T04:03:20.802397Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3.

References

Affected packages

Git / github.com/zammad/zammad

Affected ranges

Type

GIT

Repo

https://github.com/zammad/zammad

Events

Introduced

Last affected

ea50d0c06f2de01046ee305b631a42702a063cda

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.0"
        }
    ]
}

Affected versions

1.*

1.0.0

1.1.0

1.4.0

2.*

2.0.0

2.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000154.json"