CVE-2018-8888

{"id": "CVE-2018-8888", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-12-20T20:29:00.403", "references": [{"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162", "tags": ["Mitigation", "Vendor Advisory"], "source": "secure@blackberry.com"}, {"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator."}, {"lang": "es", "value": "Una vulnerabilidad Cross-Site Scripting (XSS) persistente en la consola de gesti\u00f3n de BlackBerry UEM, en versiones anteriores a la 12.10.0, podr\u00eda permitir que un atacante almacene comandos script que podr\u00edan ejecutarse posteriormente en el contexto de otro administrador de la consola."}], "lastModified": "2024-11-21T04:14:31.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C22E95BF-AF47-4FF4-AA72-C78FC5FAD786", "versionEndExcluding": "12.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "secure@blackberry.com"}