UpHeron
All vulnerabilities

Servers and applications

CVE-2019-18860

SQUID-2023:6 Cross Site Scripting in cachemgr.cgi

Severity
Medium 6.1
Published
20 Mar 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.9, 7.0.1
Also known as
GHSA-xxrg-5p7x-r66h
Sources
NVD, Project advisories (GitHub)

Description

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • Every version before 4.9
SquidServers and applications · github:squid-cache/squid
  • Every version before 7.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-18860
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-18860
  • GitHub Advisory Database https://github.com/advisories/GHSA-xxrg-5p7x-r66h
  • github.com https://github.com/squid-cache/squid/security/advisories/GHSA-xxrg-5p7x-r66h