CVE-2018-19131

squid: Cross-Site Scripting when generating HTTPS response messages about TLS errors

Loading…

Severity

Moderate

Red Hat Product Security

5.6

CVSS 3.0

Review impact separately from score.

Published · October 31, 2018

Updated · November 22, 2025

Description

A Cross-Site Scripting vulnerability has been discovered in squid in the way X.509 certificates fields are displayed in some error pages. An attacker who can control the certificate of the origin content server may use this flaw to inject scripting code in the squid generated page, which is executed on the client's browser.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Remove %D error page macro from ERR_SECURE_CONNECT_FAIL pages found under /usr/share/squid/errors/ and any custom error pages.

CVSS / CWE

CVSS 3.0 · 5.6
CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')