CVE-2018-7302

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2018-7302

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7302.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-7302

Aliases

GHSA-7f2f-crxg-cpfv

Published

2018-02-21T20:29:00Z

Modified

2024-09-03T02:24:24.308425Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.

References

https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html

Affected packages

Git / gitlab.com/tikiwiki/tiki

Affected ranges

Type: GIT
Repo: https://gitlab.com/tikiwiki/tiki
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

22ccab06582744396a4e667c34266090fd183b9f

Affected versions

10.*

10.0alpha

10.0beta

11.*

11.0beta

12.*

12.0

12.0alpha

12.0beta

12.1

12.1alpha

12.1beta

13.*

13.0

13.0beta

14.*

14.0

14.0beta

14.1

16.*

16.0beta

17.*

17.0

17.0alpha

17.0beta

17.1

3.*

3.0

3.0beta1

3.0beta2

3.0beta3

3.0beta4

3.0rc1

3.0rc2

5.*

5.0Alpha

5.0Beta1

8.*

8.0

8.0RC1

8.0beta

8.1

8.2

9.*

9.0alpha

9.0beta

9.0beta2

9.2beta1