CVE-2019-13345: debian debian_linux Cross-site Scripting

CVSS: 6.1v3.0MediumModified

AliasesALPINE-CVE-2019-13345SUSE-SU-2019:2092-1RHSA-2019:3476+4 more

Published 05-07-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-13345 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 74.48% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

49/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.0 (NVD)

EPSS score

74.48%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 14 · Related 9

DLA-2278-1 DSA-4507-1 MGASA-2019-0265 MGASA-2019-0266 OPENSUSE-SU-2019:2540-1 OPENSUSE-SU-2019:2541-1+8 more

Timeline

05-07-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.06.1v2.04.3

EPSS trend

Probability

74.48%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 74.48% on 18-09-2026

18-09-202618-10-2026

EPSS score

74.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.squid-cache.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat7 products

libecap< 0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo< 0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource< 0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel< 0:1.0.1-2.module+el8.1.0+4044+36416a77
squid< 7:4.4-8.module+el8.1.0+4044+36416a77

Show all 7

Debian3 products

squid< 4.8-1
squid3< 3.4.8-6+deb8u7
debian_linuxEOL8.0

Opensuse2 products

squid&distro=openSUSE Leap 15.0< 4.8-lp151.2.3.1
squid&distro=openSUSE Leap 15.1< 4.8-lp151.2.3.1

Suse2 products

squid&distro=SUSE Linux Enterprise Module for Server Applications 15< 4.8-5.8.1
squid&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1< 4.8-5.8.1

Alpine1 product

squid< 4.8-r0 | < 3.5.27-r1 | < 3.5.27-r3

Squid-cache1 product

squid≤ 4.7

Ubuntu1 product

squid3< 3.5.12-1ubuntu7.7 | < 3.5.27-1ubuntu1.2

7 vendors · 17 products

References

35 links

github.com/squid-cache/squid/pull/429X Refsource MISCPatchThird Party Advisory
bugs.squid-cache.org/show_bug.cgi?id=4957X Refsource MISCExploitIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2019/07/msg00006.htmlMailing ListX Refsource MLISTThird Party AdvisoryREPORT
usn.ubuntu.com/4059-1/Vendor AdvisoryX Refsource UBUNTU
usn.ubuntu.com/4059-2/Vendor AdvisoryX Refsource UBUNTU
www.securityfocus.com/bid/109095VDB EntryX Refsource BID
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-security-announce/2019-08/msg00067.htmlVendor AdvisoryX Refsource SUSE
www.debian.org/security/2019/dsa-4507Vendor AdvisoryX Refsource DEBIAN

Show all 35 references

seclists.org/bugtraq/2019/Aug/42Mailing ListX Refsource BUGTRAQ
access.redhat.com/errata/RHSA-2019:3476Vendor AdvisoryX Refsource REDHATAdvisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.htmlVendor AdvisoryX Refsource SUSE
lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlMailing ListX Refsource MLIST
security.alpinelinux.org/vuln/CVE-2019-13345Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192092-1/Advisory
bugzilla.suse.com/1140738REPORT
www.suse.com/security/cve/CVE-2019-13345WEB
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1679526REPORT
bugzilla.redhat.com/show_bug.cgi?id=1683527REPORT
bugzilla.redhat.com/show_bug.cgi?id=1703117REPORT
bugzilla.redhat.com/show_bug.cgi?id=1717046REPORT
bugzilla.redhat.com/show_bug.cgi?id=1727744REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3476.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-13345REPORT
www.cve.org/CVERecord?id=CVE-2019-13345AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-13345Advisory
ubuntu.com/security/CVE-2019-13345REPORT
ubuntu.com/security/notices/USN-4059-1Advisory
ubuntu.com/security/notices/USN-4059-2Advisory
security-tracker.debian.org/tracker/CVE-2019-13345Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities