xapian-core Cross-site Scripting vulnerability
Published: May 14, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2018-0499 (NVD)
- GHSA: GHSA-7qw4-w7hf-22q3
- Vendor Advisory: https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
GEM
SEVERITY
CVSS v3.x: 6.1 (Medium)
PATCHED VERSIONS
>= 1.4.6
DESCRIPTION
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc
in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().