CVE-2018-5411 json
Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerability
published 2018-12-13 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-17181
- cvss
- 5.4
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable.
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Pixar Tractor
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
securityfocus.com
/bid/106209
vdb-entry, third-party-advisory
-
kb.cert.org
/vuls/id/756913/
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2018-5411
- NVD CVE-2018-5411
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.