Security readout for executives and security teams
Plain-English summary
phpIPAM 1.3.2 and earlier allowed browser-executed content through a user theme setting. If an admin viewed that user in the admin panel, the admin’s browser could be affected. The main business concern is abuse of trusted admin access. The provided sources say this was fixed in version 1.4.
Executive priority
Treat this as a moderate-priority upgrade item. It is not backed by active exploitation evidence in the provided sources, but it can affect administrators and therefore should not remain unpatched on internet-facing or multi-user systems.
Technical view
This is a CWE-79 cross-site scripting issue in /app/admin/users/print-user.php. The CVE description says an attacker changes the theme parameter in user settings, and execution occurs when an admin views that user. No CVSS score is provided in the bundle. The stated fixed version is phpIPAM 1.4.
Likely exposure
Exposure applies to phpIPAM deployments running version 1.3.2 or earlier, especially where non-admin or less-trusted users can modify their user settings and are reviewed by administrators. Systems already on version 1.4 are described as fixed by the CVE source.
Exploitation context
The source describes a stored XSS-style path requiring a user setting change and an admin viewing that user in the admin panel. The CVE is not listed as KEV in the provided bundle, and no cited source here confirms active exploitation.
Researcher notes
The bundle identifies the vulnerable file and trigger condition, but does not provide CVSS details, affected CPEs, or exploitation-in-the-wild evidence. Analysis should stay focused on phpIPAM 1.3.2 and earlier and the vendor fix in 1.4.
Mitigation direction
- Upgrade phpIPAM to version 1.4, the version identified as fixed.
- Restrict phpIPAM account access to trusted users until upgraded.
- Review vendor issue and commit notes before applying changes.
- Monitor for unexpected admin-panel activity involving user profile views.
Validation and detection
- Inventory phpIPAM instances and confirm their exact version.
- Check whether any deployment is version 1.3.2 or earlier.
- Review whether untrusted users can change theme settings.
- Confirm the fix is present after upgrade to version 1.4.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000870 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/phpipam/phpipam/commit/552fbb0fc7ecb84bda4a131b4f290a3de9980040CVE reference · x_refsource_MISC
- https://github.com/phpipam/phpipam/issues/2326CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.