mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-29 09:41:31 +00:00
223 lines
7.4 KiB
JSON
223 lines
7.4 KiB
JSON
|
{
|
||
|
|
"id": "CVE-2017-12062",
|
||
|
|
"sourceIdentifier": "cve@mitre.org",
|
||
|
|
"published": "2017-08-01T15:29:00.593",
|
||
|
|
"lastModified": "2017-08-15T17:17:01.677",
|
||
|
|
"vulnStatus": "Analyzed",
|
||
|
|
"descriptions": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"lang": "es",
|
||
|
|
"value": "Se detect\u00f3 una vulnerabilidad de tipo Cross-Site Scripting (XSS) en manage_user_page.php en MantisBT en sus versiones 2.X anteriores a la 2.5.2. El campo \"filter\" no se sanitiza antes de que se renderice en la p\u00e1gina Manage User, permitiendo a los atacantes remotos ejecutar c\u00f3digo JavaScript arbitrario si se deshabilita la pol\u00edtica de seguridad de contenido (CSP)."
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"metrics": {
|
||
|
|
"cvssMetricV30": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.0",
|
||
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||
|
|
"attackVector": "NETWORK",
|
||
|
|
"attackComplexity": "LOW",
|
||
|
|
"privilegesRequired": "NONE",
|
||
|
|
"userInteraction": "REQUIRED",
|
||
|
|
"scope": "CHANGED",
|
||
|
|
"confidentialityImpact": "LOW",
|
||
|
|
"integrityImpact": "LOW",
|
||
|
|
"availabilityImpact": "NONE",
|
||
|
|
"baseScore": 6.1,
|
||
|
|
"baseSeverity": "MEDIUM"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 2.8,
|
||
|
|
"impactScore": 2.7
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV2": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "2.0",
|
||
|
|
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
||
|
|
"accessVector": "NETWORK",
|
||
|
|
"accessComplexity": "MEDIUM",
|
||
|
|
"authentication": "NONE",
|
||
|
|
"confidentialityImpact": "NONE",
|
||
|
|
"integrityImpact": "PARTIAL",
|
||
|
|
"availabilityImpact": "NONE",
|
||
|
|
"baseScore": 4.3
|
||
|
|
},
|
||
|
|
"baseSeverity": "MEDIUM",
|
||
|
|
"exploitabilityScore": 8.6,
|
||
|
|
"impactScore": 2.9,
|
||
|
|
"acInsufInfo": false,
|
||
|
|
"obtainAllPrivilege": false,
|
||
|
|
"obtainUserPrivilege": false,
|
||
|
|
"obtainOtherPrivilege": false,
|
||
|
|
"userInteractionRequired": true
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"weaknesses": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "CWE-79"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"configurations": [
|
||
|
|
{
|
||
|
|
"nodes": [
|
||
|
|
{
|
||
|
|
"operator": "OR",
|
||
|
|
"negate": false,
|
||
|
|
"cpeMatch": [
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.0:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "3E6AF670-28C3-4D7E-9EB4-E0B366CE818E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.1:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "021CC8F4-B310-4DBF-9D50-B8A357158E4D"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.2:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "D73E7205-12E1-4C57-A120-91C4C0760305"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.3:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "262EC0CC-0716-4AED-9255-13288A297879"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.0:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "2550F1FD-5104-4BAA-80F6-C6202D7326B4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.1:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "AAFDE5FC-B891-4ACA-BCAB-83EB9D49C91F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.2:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "5F89D994-7F93-4839-8A57-F4CD633576E8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.3:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "2154CE53-2DED-4023-96D5-515468E226B0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.4:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "CFF4779C-8E14-4CB1-BCB4-80F4C5020629"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "83C79C70-F6BE-485D-952A-44E5E9F16D39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.3.1:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "2B5AE145-E1B4-40EF-A3B8-A13C114D3D3B"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.3.2:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "A77FD43E-A573-408F-A566-0959DAF442AD"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.3.3:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "CCB5C9D9-8EC1-46C7-BB09-84ED20E6E61E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.4.0:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "9258FCA1-6948-4DFE-BE50-5A39B5A64120"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.4.1:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "4582B6DC-A625-41B2-ABF8-CF3BCF90A590"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.4.2:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "7F06B9BB-77DF-4185-A496-88DA8DABDDB4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.5.0:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "FE637AB4-0E47-4063-8CFF-F163A27D7F14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.5.1:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "75EE73EE-2A07-48BE-B7B9-C21643EC25B8"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"url": "http://openwall.com/lists/oss-security/2017/08/01/1",
|
||
|
|
"source": "cve@mitre.org",
|
||
|
|
"tags": [
|
||
|
|
"Mailing List",
|
||
|
|
"Third Party Advisory"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "http://openwall.com/lists/oss-security/2017/08/01/2",
|
||
|
|
"source": "cve@mitre.org",
|
||
|
|
"tags": [
|
||
|
|
"Mailing List",
|
||
|
|
"Third Party Advisory"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "http://www.securitytracker.com/id/1039030",
|
||
|
|
"source": "cve@mitre.org",
|
||
|
|
"tags": [
|
||
|
|
"Third Party Advisory",
|
||
|
|
"VDB Entry"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://github.com/mantisbt/mantisbt/commit/9b5b71dadbeeeec27efea59f562ac5bd6d2673b7",
|
||
|
|
"source": "cve@mitre.org",
|
||
|
|
"tags": [
|
||
|
|
"Patch",
|
||
|
|
"Third Party Advisory"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://mantisbt.org/bugs/view.php?id=23166",
|
||
|
|
"source": "cve@mitre.org",
|
||
|
|
"tags": [
|
||
|
|
"Exploit",
|
||
|
|
"Issue Tracking",
|
||
|
|
"Vendor Advisory"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|