CVE-2019-18860

squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.1

Review impact separately from score.

Published · November 3, 2019

Updated · June 30, 2026

Description

A flaw was found in squid. Squid, when certain web browsers are used, mishandles HTML in the host parameter to cachemgr.cgi which could result in squid behaving in unsecure way.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

The cachemgr.cgi script is not used by default. If you've set this up manually and are worried about this issue, remove it from your server.

CVSS / CWE

CVSS 3.1 · 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')