Lucene search

DwfCVE-2019-1010287

HistoryJul 17, 2019 - 9:15 p.m.

CVE-2019-1010287

2019-07-1721:15:11

CWE-79

dwf

web.nvd.nist.gov

cve-2019-1010287

timesheet next gen

1.5.3

cross site scripting

xss

web login form

reflected xss

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a “redirect” parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

Affected configurations

Nvd

Node

timesheet_next_gen_projecttimesheet_next_genRange≤1.5.3

VendorProductVersionCPE
timesheet_next_gen_projecttimesheet_next_gen*cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
timesheet_next_gen_project	timesheet_next_gen	*	cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen::::::::

CNA Affected

[
  {
    "product": "Timesheet Next Gen",
    "vendor": "Timesheet Next Gen",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.3 and earlier"
      }
    ]
  }
]

References

sourceforge.net/p/tsheetx/code/497/tree/branches/legacy/login.php#l40

sourceforge.net/p/tsheetx/discussion/779083/thread/7fcb52f696/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

Related for CVE-2019-1010287