CVE-2018-0698

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WESEEK, Inc.	GROWI	v3.2.3 and earlier

References

https://jvn.jp/en/jp/JVN96493183/index.htmlMitigation, Third Party Advisory
https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/Mitigation, Vendor Advisory
https://jvn.jp/en/jp/JVN96493183/index.htmlMitigation, Third Party Advisory
https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/Mitigation, Vendor Advisory

Timeline

Published: Jan 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-06996.1Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecif CVE-2018-07007.5YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory reso CVE-2018-07018.8BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later) allows an attack CVE-2018-07027.5Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vector CVE-2018-07037.5Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.CVE-2018-07047.5Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.CVE-2018-07059.1Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.CVE-2018-07068.8Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access se CVE-2018-07077.2Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated CVE-2018-07088.8Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated user CVE-2018-07098.8Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to r CVE-2018-07108.8Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to ru