CVE-2018-18635 www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
MediumCVSS 6.1
EPSS 0.95%
- Published
- Updated
- Exploit status
- No public exploit known
Description
www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mailcleaner | = 2018.08 | No fix listed |
| mailcleaner | = 2018.09 | No fix listed |
References
- github.com patch third-party-advisory
- github.com exploit patch third-party-advisory