CVE-2018-1000536

Source
https://nvd.nist.gov/vuln/detail/CVE-2018-1000536
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000536.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-1000536
Published
2018-06-26T16:29:02Z
Modified
2025-01-14T06:51:21Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of the running application. This attack appear to be exploitable via Victim is synchronizing data from the redis server which contains malicious key value.

References

Affected packages

Git / github.com/luin/medis

Affected ranges

Type
GIT
Repo
https://github.com/luin/medis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected