CVE-2018-13825 — Cross-site Scripting in Project Portfolio Management

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 52.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Broadcom Project Portfolio ManagementCA Technologies PPMCA Project Portfolio Management
Timeline
PublishedAug 30
Latest updateMay 13

Description

Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5ca_technologies/ppm15.3 and earlier

Patches

Patch: support.ca.com ↗Patch: support.ca.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-72wf-3vw4-gqvg: Insufficient input validation in the gridExcelExport functionality, in CA PPM 14↗2022-05-13
▶
CVEList
CVE-2018-13825: Insufficient input validation in the gridExcelExport functionality, in CA PPM 14↗2018-08-30
▶
CVE-2018-13825 — Cross-site Scripting | cvebase