CVE-2018-13065: ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element

Login Request a demo

Medium severity · published Jul 3, 2018

CVE-2018-13065

ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element

6.1

CVSS

1.4%

EPSS

No

On KEV

Description

ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 71% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MO

Modsecurity · Owasp

3.0.0 · source: NVD

Affected product

MO

Modsecurity

Owasp

All Modsecurity CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-13065

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-13065

Third Party Advisory

https://github.com/SpiderLabs/ModSecurity/issues/1829

Third Party Advisory

https://hackings8n.blogspot.com/2018/07/cve-2018-13065-modsecurity-300-has-xss.html

Broken Link

https://www.exploit-db.com/exploits/44970/