CVE-2018-25058

mediumPriorität · verfolgen · 24EPSS 0.005 · 45. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.54% (45th) EPSS

CVSS 6.1 · medium

Is it mine?

3 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · ENISA EU

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · cna@vuldb.comAusnutzbarkeit 1.6 · Auswirkung 2.5

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1022USCWE-1022US

betroffene Produkte (3)

Betroffene Produkte und Versionsbereiche.

n/a Twitter-Post-Fetcher≤ 17.xenisa_euvdEU
twitter-post-fetcher project twitter-post-fetcher< 18.0.0nvdUScpe:2.3:a:twitter-post-fetcher_project:twitter-post-fetcher:*:*:*:*:*:*:*:*
npm twitter-fetcher-js< 18.0.0osvUSpkg:npm/twitter-fetcher-js

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-m688-cx2p-rgq9Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access2022-12-29ghsa · osvUS
A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file `js/twitterFetcher.js` of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 can address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2022-12-29geändert 2026-06-17

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan