CVE-2019-13345
MediumThe cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Published Jul 5, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-13345, DEBIAN-CVE-2019-13345, DLA-1847-1, SUSE-SU-2019:2092-1, UBUNTU-CVE-2019-13345
Key Facts
Patch immediately- CVE-2019-13345 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Squid (Squid-Cache), Debian Linux, rootio-squid and 6 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 74% probability of exploitation in the next 30 days.
- Fixed versions are available, including libecap 1.0.1-2.module_el8.6.0+2741+01592ae8, libecap 1.0.1-2.module+el8.1.0+5405+03b963f4, libecap 1.0.1-2.module+el8.4.0+404+316a0dc5.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
74%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-13345 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Affected Products
96 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SquidSquid-Cache | See advisory | 4.7 |
| Debian LinuxDebian | 8.0 | n/a |
| rootio-squidrootio | See advisory | 4.8-r0 |
| squid3debian | See advisory | 3.4.8-6+deb8u7 |
| libecapalma | See advisory | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
Patched Releases
libecap
1.0.1-2.module_el8.6.0+2741+01592ae8, 1.0.1-2.module+el8.1.0+5405+03b963f4, 1.0.1-2.module+el8.4.0+404+316a0dc5
libecap-devel
1.0.1-2.module+el8.1.0+5405+03b963f4
rootio-squid
4.8-r0
Squid
3.5.21-26.17.1, 3.5.27-r1, 3.5.27-r3, 4.16-1.5, 4.6-1+deb10u1, 4.8-1, 4.8-5.8.1, 4.8-lp151.2.3.1, 4.8-r0, 4.9-4.3.2, 4.9-5.11.1, 4.9-lp150.13.1, 4.9-lp151.2.7.1, 7:3.5.20-15.39.amzn1, 7:3.5.20-15.amzn2.1, 7:3.5.20-15.el7, 7:4.4-8.module+el8.1.0+5405+03b963f4, <=4.7
squid-migration-script
7:3.5.20-15.39.amzn1, 7:3.5.20-15.amzn2.1, 7:3.5.20-15.el7
squid-sysvinit
7:3.5.20-15.amzn2.1, 7:3.5.20-15.el7
squid:4
8010020190823133019.cdc1202b
squid3
3.1.23-8.16.37.12.1, 3.4.8-6+deb8u7, 3.5.12-1ubuntu7.7, 3.5.23-5+deb9u2, 3.5.27-1ubuntu1.2
Timeline
Publicly disclosed
Jul 5, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryRHSA-2020:1068
- advisoryhttps://bugzilla.suse.com/1133089
- advisoryhttps://bugzilla.suse.com/1140738
- advisoryhttps://bugzilla.suse.com/1141329
- advisoryhttps://bugzilla.suse.com/1141330
FAQ
Common Questions.
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Affected: Squid (Squid-Cache); Debian Linux versions 8.0; rootio-squid, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including libecap 1.0.1-2.module_el8.6.0+2741+01592ae8, libecap 1.0.1-2.module+el8.1.0+5405+03b963f4, libecap 1.0.1-2.module+el8.4.0+404+316a0dc5.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-13345 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo