Lucene search

MitreCVE-2019-19857

HistoryJan 15, 2020 - 11:15 p.m.

CVE-2019-19857

2020-01-1523:15:11

CWE-287

mitre

web.nvd.nist.gov

serpico

simple report writing

collaboration tool

cve-2019-19857

security issue

admin password

xss

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change Password screen does not enhance security. This is problematic in conjunction with XSS.

Affected configurations

Nvd

Node

serpico_projectserpicoMatch1.3.0

VendorProductVersionCPE
serpico_projectserpico1.3.0cpe:2.3:a:serpico_project:serpico:1.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
serpico_project	serpico	1.3.0	cpe:2.3:a:serpico_project:serpico:1.3.0:::::::*

References

websec.nl/news.php

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

Related for CVE-2019-19857