CVE-2018-1999022

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-1999022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1999022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1999022
Related
Published
2018-07-23T16:29:00Z
Modified
2025-01-14T07:28:14.429734Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

PEAR HTMLQuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's _setOptions method, HTMLQuickFormelement's _findValue method, HTMLQuickFormelement's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/addpracticetypeid[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

References

Affected packages

Debian:11 / civicrm

Package

Name
civicrm
Purl
pkg:deb/debian/civicrm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.3.1+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/civicrm/civicrm-core

Affected ranges

Type
GIT
Repo
https://github.com/civicrm/civicrm-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
52d4ce5bdaed5d25903d47226afb56ece2769c88
Last affected
9ce0633cb2265abde8a7d7c649568ec7763ab4c2

Affected versions

4.*

4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.beta2
4.3.beta3
4.3.beta4
4.3.beta5
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.6rc1
4.4.7
4.4.7rc1
4.4.alpha1
4.4.alpha2
4.4.alpha3
4.4.beta1
4.4.beta2
4.4.beta3
4.4.beta4
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.alpha1
4.5.alpha2
4.5.beta1
4.5.beta2
4.5.beta3
4.5.beta4
4.5.beta5
4.5.beta6
4.5.beta7
4.5.beta8
4.5.beta9
4.6.0
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.15
4.6.16
4.6.17
4.6.18
4.6.19
4.6.2
4.6.20
4.6.21
4.6.22
4.6.23
4.6.24
4.6.25
4.6.26
4.6.27
4.6.28
4.6.29
4.6.3
4.6.30
4.6.31
4.6.32
4.6.33
4.6.34
4.6.35
4.6.36
4.6.37
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.6.alpha1
4.6.alpha2
4.6.alpha3
4.6.alpha4
4.6.alpha5
4.6.alpha6
4.6.alpha7
4.6.beta1
4.6.beta2
4.6.beta3
4.6.beta4
4.6.beta5
4.7.0
4.7.1
4.7.10
4.7.10-pre1
4.7.11
4.7.13
4.7.14
4.7.16
4.7.17
4.7.18
4.7.19
4.7.2
4.7.20
4.7.21
4.7.23
4.7.24
4.7.25
4.7.27
4.7.28
4.7.29
4.7.3
4.7.30
4.7.31
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.7.alpha1
4.7.alpha2
4.7.alpha3
4.7.alpha4
4.7.alpha5
4.7.beta1
4.7.beta2
4.7.beta3
4.7.beta4
4.7.beta5
4.7.beta6
4.7.beta7
4.7.beta8

5.*

5.3.0