PatchTheCVEopen-audit vulnerabilities
Recent CVEs affecting open-audit products. 6 tracked.
open-audit has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2018-04-19. Highest priority: CVE-2018-8979 (score 53/100).
- CVE-2018-9155 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject ar
- CVE-2018-9137 MEDIUM 6.8 UPGRADE Open-AudIT before 2.2 has CSV Injection.
- CVE-2018-8979 HIGH 8.8 DOWNGRADE Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences v
- CVE-2018-8978 MEDIUM 5.4 DOWNGRADE Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
- CVE-2018-8937 MEDIUM 6.1 DOWNGRADE An issue was discovered in Open-AudIT Professional 2.1
- CVE-2018-8903 MEDIUM 5.4 DOWNGRADE Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
FAQ
How do I fix open-audit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is open-audit being exploited right now?
None of the tracked open-audit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which open-audit CVE should I patch first?
CVE-2018-8979 currently ranks highest (53/100): Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences v.