nvd-json-data-feeds/CVE-2019/CVE-2019-182xx/CVE-2019-18205.json

{
  "id": "CVE-2019-18205",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-10-30T19:15:10.937",
  "lastModified": "2019-11-01T19:22:07.623",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter."
    },
    {
      "lang": "es",
      "value": "Existen  m\u00faltiples vulnerabilidades de tipo Cross-site Scripting (XSS) Reflejado en Zucchetti InfoBusiness versiones anteriores a 4.4.1 incluy\u00e9ndola. El componente de navegaci\u00f3n no sanea apropiadamente la entrada del usuario (codificada en base64). Esto tambi\u00e9n aplica para la funcionalidad search para el par\u00e1metro searchKey."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zucchetti:infobusiness:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "46271C05-580E-4CB5-8714-59DEA67AEA07"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}