Lucene search

MitreCVE-2019-15228

HistoryAug 20, 2019 - 12:15 a.m.

CVE-2019-15228

2019-08-2000:15:10

CWE-79

mitre

web.nvd.nist.gov

cve-2019-15228

fuel cms

xss

admin console

cookie stealing

authenticated account

unauthenticated visitors

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

32.0%

JSON

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.

Affected configurations

Nvd

Node

thedaylightstudiofuel_cmsRange≤1.4.4

VendorProductVersionCPE
thedaylightstudiofuel_cms*cpe:2.3:a:thedaylightstudio:fuel_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
thedaylightstudio	fuel_cms	*	cpe:2.3:a:thedaylightstudio:fuel_cms::::::::

References

github.com/daylightstudio/FUEL-CMS/issues/536

www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xss

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

32.0%

JSON

Related for CVE-2019-15228