CVE-2017-10667

{"id": "CVE-2017-10667", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-06-29T00:29:00.263", "references": [{"url": "https://github.com/zencart/zencart/issues/1443", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zhonghaozhao/zencart/issues/1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/zencart/zencart/issues/1443", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/zhonghaozhao/zencart/issues/1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS."}, {"lang": "es", "value": "En index.php en Zen Cart 1.6.0, el par\u00e1metro products_id puede provocar Cross-Site Scripting (XSS). RSA Via Lifecycle and Governance versi\u00f3n 7.0, en todos los niveles de parches y RSA Identity Management and Governance (RSA IMG) versiones 6.9.1, en todos los niveles de parches, permiten que un administrador de aplicaci\u00f3n suba archivos arbitrarios que podr\u00edan contener c\u00f3digo malicioso. El archivo malicioso podr\u00eda ejecutarse en el sistema afectado con los privilegios del usuario que est\u00e1 ejecutando la aplicaci\u00f3n."}], "lastModified": "2024-11-21T03:06:15.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zen-cart:zen_cart:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06A476EF-01B0-4A75-BAFE-944B37B48F9E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}