CVE-2018-1000154 Cross-site scripting in n/a

What is CVE-2018-1000154?

CVE-2018-1000154 is a medium-severity cross-site scripting vulnerability in Zammad Zammad, published on 5 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3.

Weakness: CWE-79

Which versions are affected by CVE-2018-1000154?

It affects 1 product.

Products include Zammad Zammad.

How do I fix CVE-2018-1000154?

No fix has been published for CVE-2018-1000154 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-1000154 being exploited?

There is no known exploitation of CVE-2018-1000154 in the wild and no public exploit code.

Other vulnerabilities in Zammad Zammad

• CVE-2026-102489 Zammad GmbH Zammad Session Fixation Exploited High 8.7
• CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Exploited High 8.5
• CVE-2022-48021 Code injection in n/a Critical 9.8
• CVE-2022-35490 Security feature bypass in n/a Critical 9.8
• CVE-2021-42090 Deserialization in n/a Critical 9.8

All Zammad Zammad vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xc5m-crhf-99w9.