CVE-2017-6958

{"id": "CVE-2017-6958", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-03-17T09:59:00.240", "references": [{"url": "https://github.com/mantisbt-plugins/source-integration/issues/205", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/mantisbt-plugins/source-integration/issues/205", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter."}, {"lang": "es", "value": "Una vulnerabilidad de XSS en la p\u00e1gina de resultados de b\u00fasqueda MantisBT Source Integration Plugin (en versiones anteriores a 2.0.2) permite a un atacante inyectar HTML o JavaScript arbitrario (si la configuraci\u00f3n CSP de MantisBT lo permite) creando cualquier par\u00e1metro v\u00e1lido."}], "lastModified": "2024-11-21T03:30:51.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:source_integration:*:*:*:*:*:mantisbt:*:*", "vulnerable": true, "matchCriteriaId": "2A38F0AE-2E2A-46DA-8493-8F45E3204E51", "versionEndIncluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}