Lucene search

[email protected]CVE-2019-19328

HistoryNov 27, 2019 - 4:15 p.m.

CVE-2019-19328

2019-11-2716:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2019-19328

wikibase

wikidata

query service

gui

html injection

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

Affected configurations

NVD

Node

wikimediawikidata_query_guiRange≤0.3.5

wikimediawikidata_query_guiMatch0.3.6-

wikimediawikidata_query_guiMatch0.3.62019-11-07

CPENameOperatorVersion
wikimedia:wikidata_query_guiwikimedia wikidata query guile0.3.5
wikimedia:wikidata_query_guiwikimedia wikidata query guieq0.3.6

CPE	Name	Operator	Version
wikimedia:wikidata_query_gui	wikimedia wikidata query gui	le	0.3.5
wikimedia:wikidata_query_gui	wikimedia wikidata query gui	eq	0.3.6

References

gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d

gerrit.wikimedia.org/r/#/c/553311/

lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

Related for CVE-2019-19328

prion1 nvd1 cvelist1