What is CVE-2018-14951?

CVE-2018-14951 is a medium-severity vulnerability; its CVE record was published on August 5, 2018. The mail message display page in SquirrelMail through 1.4.22 has XSS via a "\u003cform action='data:text" attack.

When was CVE-2018-14951 made public?

CVE-2018-14951 was made public on August 5, 2018: that is the date its CVE record's CNA, MITRE Corporation, gives for when the vulnerability was made public. The CVE record itself was published on August 5, 2018. EchelonGraph's copy of the record carries a last-modified date of November 21, 2024; the record at its source may have been updated since.

Is CVE-2018-14951 actively exploited?

CVE-2018-14951 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1.4% probability of exploitation in the next 30 days (72nd percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2018-14951?

CVE-2018-14951 has a CVSS v3 base score of 6.1 (NVD).

How do I remediate CVE-2018-14951?

A fix for CVE-2018-14951 is available: update to the fixed version the vendor names in its advisory.

CVE-2018-14951

MEDIUMNVD 6.16.1

Also known asEUVD-2018-6833 (ENISA EUVD) · GHSA-39vf-phfq-v8qr (GitHub Security Advisories)Source: ENISA EUVD

6.1EG

EchelonGraph verdictMonitorRemediate within your standard update timelines (the SSVC decision on this page).

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 1.4%CVSS: 6.1Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "