CVE-2018-5331

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4

Description The issue concerns a cross-site scripting (XSS) problem. It can be triggered via the view parameter in the include/space/space poll.php file. An example of exploitation is a request to home.php with mod=space and do=poll.

Recommendations For DiscuzX version X3.4, as a temporary workaround, consider restricting access to the space poll.php file until a patch is available. Avoid using the view parameter in the affected API endpoint until the issue is resolved.