Lucene search

[email protected]NVD:CVE-2019-20221

HistoryJan 02, 2020 - 2:16 p.m.

CVE-2019-20221

2020-01-0214:16:36

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

37.3%

JSON

In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.

Affected configurations

Nvd

Node

sitrackersupport_incident_trackerMatch3.67

VendorProductVersionCPE
sitrackersupport_incident_tracker3.67cpe:2.3:a:sitracker:support_incident_tracker:3.67:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sitracker	support_incident_tracker	3.67	cpe:2.3:a:sitracker:support_incident_tracker:3.67:::::::*

References

fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in-plugin.html

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

37.3%

JSON

Related for NVD:CVE-2019-20221

cvelist1 prion1 cve1