VULNERABILITY INTELLIGENCE

CVE-2018-13825

CVSS score6.1 MEDIUM

EPSS probability0.90%

CISA KEVNot currently listed

Published2018-08-30

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

vuln@ca.com — Third Party Advisory, VDB Entry
vuln@ca.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory