Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-16146

CVE-2019-16146: Gophish XSS Vulnerability

4.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-16146
GHSA ID
GHSA-9h9f-9q8g-6764
EPSS Score
0.46406%
CWE
CWE-79
Published
5/24/2022
Updated
7/17/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/gophish/gophishgo< 0.8.00.9.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized insertion of user.username in multiple UI feedback mechanisms. The commit 24fe998 shows critical fixes:

  1. Replaced template literals with escapeHtml() in success messages for user operations
  2. Added HTML escaping in deletion confirmation dialogs
  3. Affected code paths handle admin-facing user management features where malicious usernames could be rendered without proper output encoding, enabling stored XSS against administrators.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*op*is* t*rou** *.*.* *llows XSS vi* * us*rn*m*.

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** ins*rtion o* us*r.us*rn*m* in multipl* UI *******k m****nisms. T** *ommit ******* s*ows *riti**l *ix*s: *. R*pl**** t*mpl*t* lit*r*ls wit* *s**p**tml() in su***ss m*ss***s *or us*r op*r*tions *. ***** *TML *s