Security readout for executives and security teams
Plain-English summary
CVE-2018-19752 is a cross-site scripting issue in DomainMOD through 4.11.01. A notes field used when adding a Registrar can accept unsafe input, potentially letting attacker-controlled script run in another user’s browser. The bundle does not provide CVSS, confirmed impact details, or a named patch.
Executive priority
Treat this as a targeted application risk, not an internet-wide emergency. Prioritize if DomainMOD manages sensitive domain assets or is accessible beyond a small trusted admin group.
Technical view
The CVE describes XSS in DomainMOD through version 4.11.01, specifically the Registrar notes field at assets/add/registrar.php. Public references include an Exploit-DB entry and a GitHub issue. The source bundle does not confirm whether the flaw is stored or reflected, whether authentication is required, or which release fixes it.
Likely exposure
Exposure is limited to organizations running DomainMOD through 4.11.01, especially where untrusted or lower-privileged users can access registrar management workflows.
Exploitation context
A public Exploit-DB reference exists, but the CVE is not listed as KEV in the provided bundle. There is no source-supported evidence here of active exploitation in the wild.
Researcher notes
Key gaps remain: no CVSS, CWE, authentication requirements, exploit preconditions, or fixed-version data are present in the bundle. Do not infer active exploitation from the public exploit reference alone.
Mitigation direction
- Inventory DomainMOD deployments and identify versions through 4.11.01.
- Check DomainMOD vendor or project guidance for the fixed version.
- Restrict DomainMOD access to trusted administrators until guidance is confirmed.
- Review registrar notes content for suspicious script-like entries.
- Apply output encoding or input handling changes only per vendor-approved fixes.
Validation and detection
- Confirm whether assets/add/registrar.php is present in deployed DomainMOD instances.
- Verify the deployed DomainMOD version against 4.11.01 or earlier.
- Review who can create or edit Registrar notes.
- Inspect registrar records for unexpected HTML or script-like content.
- Check application logs for recent registrar add or edit activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-19752 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 45949CVE reference · exploit, x_refsource_EXPLOIT-DB
- https://github.com/domainmod/domainmod/issues/84CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.