CVE-2018-19836 - CVE House
Back to Database
Status published Medium CVE-2018-19836

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including...

Vulnerability Description

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19836

Credits & Attribution

No credits recorded in the NVD database.

References

More from metinfo

View All →
CVE-2022-44849
A Cross-Site Request Forgery (CSRF) in the Administrator List of...
Unknown 0
CVE-2022-23335
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability...
Critical 9.8
CVE-2022-22295
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability...
Critical 9.8
CVE-2020-21517
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the...
Medium 6.1
CVE-2020-21133
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid....
Critical 9.8

Affected Vendor

Affected Software

metinfo
Vulnerable Versions:
6.1.3

Timeline

Official Publish: December 3rd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.