CVE-2018-16165 Cross-site scripting in LogonTracer

What is CVE-2018-16165?

CVE-2018-16165 is a medium-severity cross-site scripting vulnerability in JPCERT Coordination Center LogonTracer, published on 9 Jan 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Weakness: CWE-79

Which versions are affected by CVE-2018-16165?

It affects 1 product.

Products include Jpcert Logontracer.

How do I fix CVE-2018-16165?

No fix has been published for CVE-2018-16165 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-16165 being exploited?

There is no known exploitation of CVE-2018-16165 in the wild and no public exploit code.

Other vulnerabilities in JPCERT Coordination Center LogonTracer

• CVE-2018-16167 Command injection in LogonTracer Critical 9.8
• CVE-2018-16168 Code injection in LogonTracer Critical 9.8
• CVE-2018-16166 XML external entity in LogonTracer High 8.8
• CVE-2026-33277 An OS command Injection issue exists in LogonTracer prior to v2.0.0. High 8.7
• CVE-2026-33566 Code injection in LogonTracer Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3ccj-6ghv-9ggf.