VDB
CVE-2018-25050
CVE-2018-25050
PUBLISHED
A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
EPSS 0.60% · 45.4th percentile
Risk Scores
EPSS Score
0.60%
45.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | libjs-chosen | 0, 0.9.15-2 |
| Ubuntu:22.04:LTS | libjs-chosen | 0, 1.8.7+dfsg-2 |
| Ubuntu:20.04:LTS | libjs-chosen | 0, * |
| Ubuntu:16.04:LTS | libjs-chosen | 0, 0.9.11-2 |
| Ubuntu:25.10 | libjs-chosen | *, 0 |
| Ubuntu:24.04:LTS | libjs-chosen | 0, 1.8.7+dfsg-2 |
Timeline
- Dec 28, 2022 CVE Published
- Dec 29, 2022 EPSS Score
- Jan 9, 2023 CVE Updated
- Feb 8, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 22, 2023 EPSS Score
- May 2, 2023 EPSS Score
- Jun 13, 2023 EPSS Score
- Jul 24, 2023 EPSS Score
- Sep 3, 2023 EPSS Score
- Oct 15, 2023 EPSS Score
- Nov 25, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-25050 third-party-advisory
- https://github.com/harvesthq/chosen/releases/tag/v1.8.7 third-party-advisory
- https://github.com/harvesthq/chosen/pull/2997 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-25050 third-party-advisory