DEBIAN-CVE-2018-1999022
- Source
- https://security-tracker.debian.org/tracker/CVE-2018-1999022
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1999022.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2018-1999022
- Upstream
- Published
- 2018-07-23T16:29:00.227Z
- Modified
- 2025-11-14T03:12:01.702690Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
PEAR HTMLQuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's _setOptions method, HTMLQuickFormelement's _findValue method, HTMLQuickFormelement's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/addpracticetypeid[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
- References
Affected packages
Debian:11 / civicrm
Package
- Name
- civicrm
- Purl
- pkg:deb/debian/civicrm?arch=source