CVE-2018-17783

{"id": "CVE-2018-17783", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-10-30T18:29:00.673", "references": [{"url": "https://mantisbt.org/blog/archives/mantisbt/613", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://mantisbt.org/bugs/view.php?id=24814", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://mantisbt.org/blog/archives/mantisbt/613", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://mantisbt.org/bugs/view.php?id=24814", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en la p\u00e1gina Edit Filter (manage_filter_edit page.php) en MantisBT, desde la versi\u00f3n 2.1.0 hasta la 2.17.1, permite que los atacantes remotos (si los derechos de acceso lo permiten) inyecten c\u00f3digo arbitrario (si la configuraci\u00f3n CSP lo permite) mediante un nombre de proyecto manipulado."}], "lastModified": "2024-11-21T03:54:58.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "742C49AD-3696-4B9D-8AAF-A1C6E0F44CEC", "versionEndIncluding": "2.17.1", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}