---
id: 4214
title: "[CVE-2018-11352] Wallabag 2.2.3 to 2.3.2 - Stored Cross-Site Scripting"
cve: CVE-2018-11352
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting"
published_at: "2018-09-17T00:00:00Z"
tags: ["open-source", "vulnerability", "session-hijacking", "stored-xss", "wallabag", "cve-2018-11352"]
phying_url: "https://phying.com/item/4214"
lang: en
---

# [CVE-2018-11352] Wallabag 2.2.3 to 2.3.2 - Stored Cross-Site Scripting

## Summary

A stored XSS in Wallabag 2.2.3 through 2.3.2 (CVE-2018-11352) hides in the settings page and fires when an administrator visits it, enabling session theft.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2018-11352
- **Published:** 2018-09-17T00:00:00Z
- **Original:** https://bishopfox.com/blog/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting
- **Phying News:** https://phying.com/item/4214