CVE-2018-18864

Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.

CVSS v3.0

9.6 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

2.57% chance of exploitation in the next 30 days, 84th percentile

Published

2018-11-20

Updated

2024-08-05

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/150135/Loadbalancer.org-Enterprise-VA-MAX-Cross-Site…
• http://seclists.org/fulldisclosure/2018/Nov/5

References

• CVE Record
• NVD entry

Related

• CVE-2018-18862
• CVE-2018-18865
• CVE-2018-18861
• CVE-2018-18871
• CVE-2018-18860
• CVE-2018-18872