Packagist/phraseanet/phraseanet CVE-2018-25157: medium 6.4, EPSS 0.28%
Phraseanet vulnerable to stored cross-site scripting through crafted file names
Action: No fix published. Pin and monitor.
Affected
No affected ranges in the source.
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-gcpq-mrgg-v5f3
- https://nvd.nist.gov/vuln/detail/CVE-2018-25157
- https://github.com/alchemy-fr/Phraseanet
- https://www.exploit-db.com/exploits/46935
- https://www.phraseanet.com
- https://www.phraseanet.com/en/download
- https://www.vulncheck.com/advisories/phraseanet-stored-xss-via-document-upload
CVE-2018-25157 · published · modified · JSON