Back to Database
Status published
Medium
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS...
Vulnerability Description
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13345
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/squid-cache/squid/pull/429
- https://bugs.squid-cache.org/show_bug.cgi?id=4957
- https://lists.debian.org/debian-lts-announce/2019/07/msg00006.html
- https://usn.ubuntu.com/4059-1/
- https://usn.ubuntu.com/4059-2/
- http://www.securityfocus.com/bid/109095
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2ERPHSPUGOYVVRPQRASQBFGS2EJISFC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00067.html
- https://www.debian.org/security/2019/dsa-4507
- https://seclists.org/bugtraq/2019/Aug/42
- https://access.redhat.com/errata/RHSA-2019:3476
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
More from squid-cache
View All →CVE-2025-62168
Squid vulnerable to information disclosure via authentication credential leakage in error handling
Critical
10
CVE-2025-54574
Squid's URN Handling can lead to Buffer Overflow
Critical
9.3
CVE-2024-45802
Squid Denial of Service
High
7.5
CVE-2024-37894
Squid vulnerable to heap corruption in ESI assign
Medium
6.3
CVE-2024-25617
Denial of Service in HTTP Header parser in squid proxy
Medium
5.3
Affected Vendor
squid-cache
View all reports →Affected Software
squid, debian linux
Vulnerable Versions:
0, 8.0
Timeline
Official Publish:
July 5th, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.