CVE-2018-11012

Name of the Vulnerable Software and Affected Versions ruibaby Halo version 0.0.2

Description The issue concerns a stored XSS that occurs via the loginName and loginPwd parameters in a failed login attempt. This is related to the AdminController.java.

Recommendations For ruibaby Halo version 0.0.2, avoid using the loginName and loginPwd parameters in the affected login functionality until a fix is available. As a temporary workaround, consider restricting access to the login endpoint to minimize the risk of exploitation.