CVE-2018-11512

{"id": "CVE-2018-11512", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-05-28T13:29:00.297", "references": [{"url": "https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/Creatiwity/wityCMS/issues/150", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/44790/", "tags": ["Exploit", "Patch", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting (XSS) vulnerability in the \"Website's name\" field found in the \"Settings\" page under the \"General\" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general."}, {"lang": "es", "value": "Se ha descubierto un problema en Moodle 3.x. Un usuario autenticado puede a\u00f1adir bloques HTML que contienen scripts a su Dashboard; esto no suele suponer un problema de seguridad porque los dashboards personales solo son visibles para este usuario. Mediante esta vulnerabilidad de seguridad, los usuarios pueden mover estos bloques a otras p\u00e1ginas, donde pueden ser vistos por otros usuarios."}], "lastModified": "2018-06-29T13:31:34.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:creatiwity:witycms:0.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "318318D8-E365-453F-9C38-5222ACF2707F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}