What is GHSA-7qw4-w7hf-22q3?

GHSA-7qw4-w7hf-22q3 is a security advisory published by GitHub Security Advisories with Medium severity. xapian-core Cross-site Scripting vulnerability

Which CVE IDs does GHSA-7qw4-w7hf-22q3 cover?

GHSA-7qw4-w7hf-22q3 covers the following CVE IDs: CVE-2018-0499. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7qw4-w7hf-22q3?

GHSA-7qw4-w7hf-22q3 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7qw4-w7hf-22q3?

GHSA-7qw4-w7hf-22q3 affects 1 product, including: rubygems/xapian-core:\u003c 1.4.6.

GHSA-7qw4-w7hf-22q3MediumCVSS 6.1

xapian-core Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

March 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-0499 →

📋 Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

🎯 Affected products1

rubygems/xapian-core:< 1.4.6

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-0499
https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02
https://usn.ubuntu.com/3709-1/
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/xapian-core/CVE-2018-0499.yml
https://github.com/advisories/GHSA-7qw4-w7hf-22q3