A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6.
    Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The     manipulation of the argument group_label leads to cross site scripting. The attack may be launched     remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is     77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The     identifier of this vulnerability is VDB-216956. (CVE-2018-25050)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6.
    Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The
    manipulation of the argument group_label leads to cross site scripting. The attack may be launched
    remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is
    77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The
    identifier of this vulnerability is VDB-216956. (CVE-2018-25050)

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-34 advisory.

  - Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of     the third-party components (OpenSSL, curl, chosen, datatables) were found to contain vulnerabilities, and     updated versions have been made available by the providers. Out of caution and in line with best practice,     Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network     Monitor 6.3.0 updates OpenSSL to version 3.0.11, curl to version 8.4.0, chosen to version 1.8.7 and datatables     to version 1.13.6. (CVE-2018-25050, CVE-2021-23445, CVE-2023-0465, CVE-2023-0466, CVE-2023-1255, CVE-2023-2650,     CVE-2023-3446, CVE-2023-38039, CVE-2023-3817, CVE-2023-4807)

  - Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to     NT AUTHORITY\SYSTEM on Windows hosts. (CVE-2023-5622)

  - NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run     arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location. (CVE-2023-5623)

  - Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This     could allow an admin user to alter parameters that could potentially allow a blindSQL injection. (CVE-2023-5624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262997	Linux Distros Unpatched Vulnerability : CVE-2018-25050	Nessus	Misc.	medium
420316	SCA: security update for harvesthq/chosen (GHSA-x5q4-m45m-fm94)	Tenable Cloud Security	SCA Checks	medium
420316	SCA: security update for harvesthq/chosen (GHSA-x5q4-m45m-fm94)	Tenable Self-Hosted Container Security	SCA Checks	medium
183921	Nessus Network Monitor < 6.3.0 Multiple Vulnerabilities (TNS-2023-34)	Nessus	Misc.	high

Detections

Analytics

CVE-2018-25050

medium

Tenable Plugins

medium

medium

medium

high