Medium severity · published Dec 20, 2018
CVE-2018-1000847
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code…
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Full Name in their account details. The victim (e.g. the administrator of the FreshDNS instance) opens the User List in the admin interface.. This vulnerability appears to have been fixed in 1.0.5 and later.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Freshdns · Freshdns Project
through 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000847
Patch
https://github.com/funzoneq/freshdns/issues/16
Patch
https://github.com/funzoneq/freshdns/pull/6/commits/48b5ca812a89689fd2f32248875cedcba8c9014f
More from Freshdns
8.8
CVE-2018-1000846
FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in…