VulnerabilityModified

CVE-2018-1000528

MEDIUM 6.1EPSS 46.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 46.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 46.64% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: debian/debian linux · gonicus/gosa
Source: cve@mitre.org

EPSS trend

EPSS moved from 20.8% on 21 September 2026 to 46.6% on 27 October 2026, peaking at 46.8% on 22 September 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001Patch, Third Party Advisory
https://github.com/gosa-project/gosa-core/issues/14Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00028.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4239Third Party Advisory
https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001Patch, Third Party Advisory
https://github.com/gosa-project/gosa-core/issues/14Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00028.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4239Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.