CVE-2018-11352: Wallabag Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2018-11352: Wallabag cross-site scripting (XSS) vulnerability. Affects wallabag/wallabag versions >= 2.2.3, < 2.3.3. Fixed in 2.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wallabag is an open-source application that allows users to save web pages for later reading. It provides a self-hosted solution for saving articles, blog posts, and other online content. The application is built using the Packagist ecosystem and is commonly used by administrators to manage and configure their Wallabag instances. However, versions 2.2.3 to 2.3.2 of Wallabag are affected by a cross-site scripting (XSS) vulnerability that resides within the configuration page.
Vulnerability Detail
The identified vulnerability in Wallabag allows for the execution of a JavaScript payload whenever an administrator visits the configuration page. This stored XSS vulnerability poses a risk to administrators as it can be exploited with authentication, enabling attackers to target and compromise their sessions. The vulnerability has a CVSS score of 4.0, indicating a moderate severity level. It falls under the CWE-79 category, which refers to cross-site scripting vulnerabilities.
How To Fix
Minimum fixed version
2.3.3
This is the first release that contains the fix.
composer require wallabag/wallabag:2.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched version is the only recommended solution.
Conclusion
The Wallabag application versions 2.2.3 to 2.3.2 are affected by a cross-site scripting (XSS) vulnerability that can be exploited by authenticated attackers to compromise administrator sessions. To mitigate this vulnerability, it is crucial to upgrade to Wallabag version 2.3.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wallabag/wallabag →
FAQ
Wallabag is an open-source application that allows users to save web pages for later reading. It provides a self-hosted solution for managing and organizing online content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
The Wallabag XSS vulnerability affects administrators by enabling attackers to execute JavaScript payloads and potentially compromise their sessions. This can lead to unauthorized access and data theft.
Yes, the vulnerability can be fixed by upgrading Wallabag to version 2.3.3 or later. This version includes a patch that addresses the XSS vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the only recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for wallabag/wallabag.
