Vulnerability Details : CVE-2018-1000642
FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session information. This vulnerability appears to have been fixed in after commit 22b09a3.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2018-1000642
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 23 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2018-1000642
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2018-1000642
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1000642
-
https://0dd.zone/2018/08/05/FlightAirMap-Reflected-XSS/
FlightAirMap Reflected XSS | 0dd - The Zero (0) Day DivisionThird Party Advisory
-
https://github.com/Ysurac/FlightAirMap/issues/410
Reflected XSS in registration-sub-menu.php · Issue #410 · Ysurac/FlightAirMap · GitHubThird Party Advisory
Products affected by CVE-2018-1000642
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:0.1:beta1:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta13:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta14:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta19:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta20:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta21:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:0.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:0.6:beta1:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta16:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta18:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:0.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta15:*:*:*:*:*:*
- cpe:2.3:a:flightairmap:flightairmap:1.0:beta17:*:*:*:*:*:*