CVE-2018-0499

MEDIUM

xapian-core < 1.4.6 - Cross-Site Scripting in MSet Snippet HTML Escaping

Title source: llm
STIX 2.1

Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3709-1/
Mailing List, Vendor Advisory x_refsource_confirm
https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html

Scores

CVSS v3 6.1
EPSS 0.0037
EPSS Percentile 59.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
canonical/ubuntu_linux 17.10
canonical/ubuntu_linux 18.04
rubygems/xapian-core 0 - 1.4.6RubyGems
xapian/xapian-core < 1.4.6
Published Jul 02, 2018
Tracked Since Feb 18, 2026