CVE-2018-1000160

{"id": "CVE-2018-1000160", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-04-18T19:29:00.393", "references": [{"url": "http://embed.plnkr.co/xHbhB29JWWyMUMeHsLrm", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/RisingStack/protect/blob/60b0c91e86686d34e5202419ce9ae7e8dc08edcd/lib/rules/xss.js#L4-L13", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/RisingStack/protect/issues/16", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings(26) detailed in the GitHub issue #16."}, {"lang": "es", "value": "RisingStack protect, en su versi\u00f3n 1.2.0 y anteriores, contiene una vulnerabilidad de Cross Site Scripting (XSS) en la funci\u00f3n isXss() en lib/rules/xss.js que puede resultar en que las cadenas XSS peligrosas se validan como seguras. Este ataque parece ser explotable mediante una serie de cadenas XSS (26), detalladas en la publicaci\u00f3n n\u00famero 16 de GitHub."}], "lastModified": "2018-05-21T16:11:32.897", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:risingstack:protect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0455B8E2-09DD-4370-8192-0083FF126D39", "versionEndIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}