Lucene search

MitreCVE-2020-35228

HistoryMar 10, 2021 - 7:15 p.m.

CVE-2020-35228

2021-03-1019:15:12

CWE-79

mitre

web.nvd.nist.gov

cve-2020-35228

cross-site scripting

xss

netgear

jgs516pe

gs116ev2

vulnerability

administration web panel

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter.

Affected configurations

Nvd

Node

netgeargs116e_firmwareMatch2.6.0.43

AND

netgeargs116eMatchv2

Node

netgearjgs516pe_firmwareMatch2.6.0.43

AND

netgearjgs516peMatch-

VendorProductVersionCPE
netgeargs116e_firmware2.6.0.43cpe:2.3:o:netgear:gs116e_firmware:2.6.0.43:*:*:*:*:*:*:*
netgeargs116ev2cpe:2.3:h:netgear:gs116e:v2:*:*:*:*:*:*:*
netgearjgs516pe_firmware2.6.0.43cpe:2.3:o:netgear:jgs516pe_firmware:2.6.0.43:*:*:*:*:*:*:*
netgearjgs516pe-cpe:2.3:h:netgear:jgs516pe:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	gs116e_firmware	2.6.0.43	cpe:2.3:o:netgear:gs116e_firmware:2.6.0.43:::::::*
netgear	gs116e	v2	cpe:2.3:h:netgear:gs116e:v2:::::::*
netgear	jgs516pe_firmware	2.6.0.43	cpe:2.3:o:netgear:jgs516pe_firmware:2.6.0.43:::::::*
netgear	jgs516pe	-	cpe:2.3:h:netgear:jgs516pe:-:::::::*

References

research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2020-35228