CVE-2018-18964

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page

published November 6, 2018

CVSS
—
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01017 · 62.8th percentile
Published
2018-11-06T04:00Z
EPSS history
Timeline
  • 06 NOV 04:00Z
    osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
    cvelistv5