CVE-2018-1000528: GOsa change password form cross-site scripting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 3.0 base score is 6.1 (Medium) with user interaction required, but the high EPSS percentile warrants prompt patching.

What it is

GOsa before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a reflected cross-site scripting flaw in the change password form (html/password.php, issue #308). An attacker can inject arbitrary web script or HTML that executes in the victim's browser session. The record does not list specific affected version numbers, only the fixing commit.

Impact

An attacker can run script in the context of the GOsa web interface, potentially stealing session cookies or credentials and performing actions as the victim. The CVSS scope change (S:C) means impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the change password form; the CVSS vector shows no privileges required (PR:N) but user interaction is required (UI:R), since the victim must open a crafted page. No authentication is needed to deliver the payload, though the victim is likely a logged-in GOsa user.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record. EPSS gives a 30-day probability of 0.46821 (98.8th percentile), indicating elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the fix at commit 56070d6289d47ba3f5918885954dcceb75606001 or the Debian security update DSA-4239 / LTS announcement for your release.
• If patching is delayed, restrict network access to the GOsa web interface to trusted users and networks.
• Deploy a WAF or input filtering rule that blocks script payloads in the change password form parameters.
• Set session cookies HttpOnly and Secure to limit script-based session theft.
• Review and sanitize output encoding in html/password.php and similar form handlers.

Detection

• Search web server and proxy logs for script tags or encoded script payloads in requests to html/password.php.
• Monitor for anomalous requests to the change password endpoint with unexpected query or body parameters.
• Alert on outbound or inline script execution patterns tied to GOsa sessions in browser or endpoint telemetry.
• Check for unexpected changes to GOsa user passwords or account settings following suspicious page visits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.