CVE-2018-1000611

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-09 · updated 2026-06-17
Weakness: CWE-79

Description

SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.

Affected products

Openconext Engineblock: from 5.7.0 through 5.7.3

References

https://github.com/OpenConext/OpenConext-engineblock/pull/563/files
https://github.com/OpenConext/OpenConext-engineblock/pull/563/files

Get alerted when CVE-2018-1000611 or the next vulnerability affects your stack