diff --git a/cves/2018/CVE-2018-11473.yaml b/cves/2018/CVE-2018-11473.yaml index 75eafaaa3b..9419700bfe 100644 --- a/cves/2018/CVE-2018-11473.yaml +++ b/cves/2018/CVE-2018-11473.yaml @@ -1,15 +1,15 @@ id: CVE-2018-11473 info: - name: Monstra CMS V3.0.4 - Cross-Site Scripting + name: Monstra CMS 3.0.4 - Cross-Site Scripting author: ritikchaddha severity: medium description: | - Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). + Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://github.com/monstra-cms/monstra/issues/446 - - https://nvd.nist.gov/vuln/detail/CVE-2018-11473 - https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page + - https://nvd.nist.gov/vuln/detail/CVE-2018-11473 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -61,3 +61,5 @@ requests: regex: - 'id="csrf" name="csrf" value="(.*)">' internal: true + +# Enhanced by md on 2023/01/30