CVE-2017-12460

{"id": "CVE-2017-12460", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2017-10-30T14:29:00.797", "references": [{"url": "https://www.barco.com/en/Support/software/R33050037", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/knowledge-base/KB5169", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/support/software/R33050020", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.barco.com/en/Support/software/R33050037", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/knowledge-base/KB5169", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.barco.com/en/support/software/R33050020", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an HTML injection can be triggered as special characters are not neutralized before output."}, {"lang": "es", "value": "Se ha descubierto un problema en Barco ClickShare con firmware CSM-1 anterior a v1.7.0.3 y firmware CSC-1 anterior a v1.10.0.10. Un usuario autenticado puede gestionar la colecci\u00f3n de fondos de pantalla en la interfaz de usuario web para que se muestre como fondo en el producto ClickShare. Mediante la subida de un fondo de pantalla con un nombre especialmente manipulado, se puede desencadenar una inyecci\u00f3n HTML, ya que los caracteres especiales no se neutralizan antes de la salida."}], "lastModified": "2024-11-21T03:09:33.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_csm-1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "153A768C-A1C0-4E5D-81CE-C0760019C3F9", "versionEndExcluding": "1.7.0.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_csm-1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B6332071-FA97-4220-AC19-0C62C6593BE1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:barco:clickshare_csc-1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9E89FB2-F4E3-4F89-AF1D-AF3D207BEE87", "versionEndExcluding": "1.10.0.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:barco:clickshare_csc-1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5A88BAB0-B290-46CB-91BD-F6872C838FC5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}