Lucene search

MitreCVE-2017-11175

HistoryJul 05, 2018 - 6:29 p.m.

CVE-2017-11175

2018-07-0518:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2017-11175

j2 innovations

fin stack 4.0

authentication

webform

reflected xss

vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.0%

JSON

In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.

Affected configurations

Nvd

Node

siemensfin_stackMatch4.0

VendorProductVersionCPE
siemensfin_stack4.0cpe:2.3:a:siemens:fin_stack:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	fin_stack	4.0	cpe:2.3:a:siemens:fin_stack:4.0:::::::*

References

github.com/miruser/Roche-CVEs/blob/master/CVE-2017-11175.md

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.0%

JSON

Related for CVE-2017-11175