CVE-2018-13983: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 24, 2022 (updated July 19, 2023)

ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php.

References

packetstormsecurity.com/files/150990/ImpressCMS-1.3.10-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2019/Jan/8
github.com/advisories/GHSA-g32q-4fhf-cq72
nvd.nist.gov/vuln/detail/CVE-2018-13983
www.netsparker.com/web-applications-advisories/ns-18-033-cross-site-scripting-in-impresscms/

Detect and mitigate CVE-2018-13983 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →