CVE-2018-1000557

{"id": "CVE-2018-1000557", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-06-26T16:29:02.820", "references": [{"url": "https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.secuvera.de/advisories/secuvera-SA-2017-03.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be exploitable via Victim must open a crafted link to the application. This vulnerability appears to have been fixed in ocsreports 2.4.1."}, {"lang": "es", "value": "OCS Inventory OCS Inventory NG version ocsreports 2.4 contiene una vulnerabilidad Cross-Site Scripting (XSS) en el formulario de inicio de sesi\u00f3n y la funci\u00f3n search que puede resultar en que un atacante podr\u00eda ejecutar c\u00f3digo arbitrario (JavaScript) en el navegador de las v\u00edctimas. Este ataque parece ser explotable mediante una v\u00edctima que abra un enlace especialmente manipulado a la aplicaci\u00f3n. La vulnerabilidad parece haber sido solucionada en ocsreports 2.4.1."}], "lastModified": "2018-08-20T13:34:18.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ocsinventory-ng:ocsinventory_ng:2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B99848E4-225D-4B9F-B665-C80E0CC9F3DA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}