Lucene search

VulDBCVE-2016-15010

HistoryJan 05, 2023 - 9:15 a.m.

CVE-2016-15010

2023-01-0509:15:08

CWE-79

VulDB

web.nvd.nist.gov

university of cambridge

django-ucamlookup

vulnerability

cross site scripting

remote attack

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.3%

JSON

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 is able to address this issue. The identifier of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected configurations

Nvd

Vulners

Node

django-ucamlookup_projectdjango-ucamlookupRange<1.9.2

VendorProductVersionCPE
django-ucamlookup_projectdjango-ucamlookup*cpe:2.3:a:django-ucamlookup_project:django-ucamlookup:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
django-ucamlookup_project	django-ucamlookup	*	cpe:2.3:a:django-ucamlookup_project:django-ucamlookup::::::::

CNA Affected

[
  {
    "vendor": "University of Cambridge",
    "product": "django-ucamlookup",
    "versions": [
      {
        "version": "1.9.0",
        "status": "affected"
      },
      {
        "version": "1.9.1",
        "status": "affected"
      }
    ],
    "modules": [
      "Lookup Handler"
    ]
  }
]

References

github.com/uisautomation/django-ucamlookup/commit/5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3

github.com/uisautomation/django-ucamlookup/releases/tag/1.9.2

vuldb.com/?ctiid.217441

vuldb.com/?id.217441

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.3%

JSON

Related for CVE-2016-15010