ISOMAN

CVE

CVE-2018-19630

cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrated by a cgi-bin/?[XSS] URI.

Severity
MEDIUM
CVSS
6.1
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
OpenWrt25.12.4 x86_64 target x86-64unknownsource
OpenWrt25.12.4 x86 target x86-genericunknownsource
OpenWrt25.12.4 x86 target x86-geodeunknownsource
OpenWrt25.12.4 x86 target x86-legacyunknownsource
OpenWrt25.12.5 x86_64 target x86-64unknownsource
OpenWrt25.12.5 x86 target x86-genericunknownsource
OpenWrt25.12.5 x86 target x86-geodeunknownsource
OpenWrt25.12.5 x86 target x86-legacyunknownsource
OpenWrt25.12.6 x86_64 target x86-64unknownsource
OpenWrt25.12.6 x86 target x86-genericunknownsource
OpenWrt25.12.6 x86 target x86-geodeunknownsource
OpenWrt25.12.6 x86 target x86-legacyunknownsource

References

  1. https://bugs.openwrt.org/index.php?do=details&task_id=1974
  2. https://bugs.openwrt.org/index.php?do=details&task_id=1974