Lucene search

[email protected]NVD:CVE-2020-19007

HistoryAug 26, 2020 - 2:15 p.m.

CVE-2020-19007

2020-08-2614:15:10

CWE-79

[email protected]

web.nvd.nist.gov

halo blog

malicious code execution

comment submission

javascript code

victim user's browser

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user’s browser.

Affected configurations

Nvd

Node

halohaloMatch1.2.0

VendorProductVersionCPE
halohalo1.2.0cpe:2.3:a:halo:halo:1.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
halo	halo	1.2.0	cpe:2.3:a:halo:halo:1.2.0:::::::*

References

github.com/halo-dev/halo/issues/547

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

Related for NVD:CVE-2020-19007

prion1 osv1 cve1 cvelist1