Lucene search

ZteCVE-2019-3413

HistoryJun 11, 2019 - 8:29 p.m.

CVE-2019-3413

2019-06-1120:29:01

CWE-79

zte

web.nvd.nist.gov

cve-2019-3413

zte

netnumen

dap

xss

vulnerability

web application

hijacking

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applications, which results in users being hijacked.

Affected configurations

Nvd

Node

ztenetnumen_dap_firmwareRange≤20.18.40.r7.b1

AND

ztenetnumen_dapMatch-

VendorProductVersionCPE
ztenetnumen_dap_firmware*cpe:2.3:o:zte:netnumen_dap_firmware:*:*:*:*:*:*:*:*
ztenetnumen_dap-cpe:2.3:h:zte:netnumen_dap:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zte	netnumen_dap_firmware	*	cpe:2.3:o:zte:netnumen_dap_firmware::::::::
zte	netnumen_dap	-	cpe:2.3:h:zte:netnumen_dap:-:::::::*

CNA Affected

[
  {
    "product": "NetNumen DAP",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "All versions up to NetNumen DAP V20.18.40.R7.B1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010797

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2019-3413