CVE-2018-25084 json
Ping Identity Self-Service Account Manager SSAMController.java cross site scripting
published 2023-04-10 3 y ago modified 2026-06-17 4 mo ago also EUVD-2018-13838
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
Patch / fix
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Ping Identity Self-Service Account Manager
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/pingidentity/ssam/commit/f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251
patch
-
github.com
/pingidentity/ssam/releases/tag/ssam-1.1.3
patch, release-notes
-
vuldb.com
/?id.225362
vdb-entry, technical-description, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.225362
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2018-25084
- NVD CVE-2018-25084
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.