CVE-2019-13345 Cross-site scripting in n/a
Cross-site scripting in Squid's cachemgr.cgi allows attackers to inject scripts via user_name or auth parameters, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-13345?
CVE-2019-13345 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 5 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Weakness: CWE-79
Which versions are affected by CVE-2019-13345?
It affects 2 products.
Linux distribution packages (14)
libecap AlmaLinux:8 | All versions | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
libecap-devel AlmaLinux:8 | All versions | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
libecap Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
libecap-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
libecap-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
libecap-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.1-2.module+el8.1.0+4044+36416a77 |
squid Red Hat:enterprise_linux:8::appstream | All versions | 7:4.4-8.module+el8.1.0+4044+36416a77 |
squid-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 7:4.4-8.module+el8.1.0+4044+36416a77 |
squid-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 7:4.4-8.module+el8.1.0+4044+36416a77 |
libecap Rocky Linux:8 | All versions | 0:1.0.1-2.module+el8.4.0+404+316a0dc5 |
squid SUSE:Linux Enterprise Module for Server Applications 15 | All versions | 4.8-5.8.1 |
squid SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 4.8-5.8.1 |
squid openSUSE:Leap 15.0 | All versions | 4.8-lp151.2.3.1 |
squid openSUSE:Leap 15.1 | All versions | 4.8-lp151.2.3.1 |
Products include Debian Debian Linux, Squid-Cache Squid.
How do I fix CVE-2019-13345?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-13345 being exploited?
There is no known exploitation of CVE-2019-13345 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-13345, ALSA-2019:3476, DEBIAN-CVE-2019-13345, DLA-1847-1, GHSA-3cp8-63m9-w97j, RHSA-2019:3476 and 4 more.