PT-2018-11736

CVE-2018-13312

·

Published

2018-11-26

·

Updated

2018-12-19

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8
Description The issue allows attackers to execute arbitrary JavaScript by modifying the Input your notice URL field in notice gen.htm, potentially leading to cross-site scripting.
Recommendations For TOTOLINK A3002RU version 1.0.8, consider restricting access to the notice gen.htm page until a fix is available, and avoid using the Input your notice URL field to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2018-13312
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com