The Reporting Addon for CUBA Platform has Persistent XSS

MEDIO 5.4CVE-2018-20663 · GHSA-rff7-964g-pppx · Published 03/01/2019 · updated 17/06/2026

En resumen

CVE-2018-20663 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a com.haulmont.cuba:cuba-web-toolkit, cuba platform (haulmont), reporting (haulmont).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.67%, mayor que el 52.0% de las vulnerabilidades.
Solución: actualizar a 6.10.7, 6.9.8, 6.8.15 o posterior.

Package	Affected versions	Patched versions
com.haulmont.cuba:cuba-web-toolkit Maven	`≥ 6.10.0, < 6.10.7≥ 6.9.0, < 6.9.8< 6.8.15`	`6.10.76.9.86.8.15`
cuba platform haulmont	`≤ 6.10.7`	No fix yet
reporting haulmont	`≤ 2019-01-02`	No fix yet

Description

The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.

NVD description

The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.

References

nvd.nist.gov/vuln/detail/CVE-2018-20663 · ADVISORY
cuba-platform/cuba · WEB
cuba-platform/reports · WEB
cuba-platform/cuba commit be6aa41 · WEB
cuba-platform/cuba commit e9f972b · WEB
cuba-platform/cuba commit ec8784d · WEB
cuba-platform/reports · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free