---
id: 4210
title: "YunoHost 2.7.2 to 2.7.14 - Multiple Vulnerabilities"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/yunohost-2-7-2-to-2-7-14-advisory"
published_at: "2018-10-30T00:00:00Z"
tags: ["vulnerability", "session-hijacking", "stored-xss", "yunohost", "http-header-injection", "cve-2018-11348"]
phying_url: "https://phying.com/item/4210"
lang: en
---

# YunoHost 2.7.2 to 2.7.14 - Multiple Vulnerabilities

## Summary

YunoHost 2.7.2 to 2.7.14 vulnerabilities: stored XSS in profile fields (CVE-2018-11348) and an HTTP header injection (CVE-2018-11347) that together can hijack user sessions.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2018-10-30T00:00:00Z
- **Original:** https://bishopfox.com/blog/yunohost-2-7-2-to-2-7-14-advisory
- **Phying News:** https://phying.com/item/4210