CVE-2018-9282

{"id": "CVE-2018-9282", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-09-21T16:29:01.673", "references": [{"url": "https://www.bishopfox.com/news/2018/09/subsonic-6-1-1-multiple-vulnerabilities/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS vulnerability in the add parameter to podcastReceiverAdmin.view; no administrator access is required. By injecting a JavaScript payload, this flaw could be used to manipulate a user's session, or elevate privileges by targeting an administrative user."}, {"lang": "es", "value": "Se ha descubierto una vullnerabilidad Cross-Site Scripting (XSS) en Subsonic Media Server 6.1.1. El formulario de suscripci\u00f3n al podcast se ve afectado por una vulnerabilidad Cross-Site Scripting (XSS) persistente en el par\u00e1metro add en podcastReceiverAdmin.view. No se requiere acceso administrador. Al inyectar una carga \u00fatil de JavaScript, este fallo podr\u00eda utilizarse para manipular la sesi\u00f3n de un usuario o para elevar los privilegios atacando a un usuario administrativo."}], "lastModified": "2018-11-09T17:45:32.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:subsonic:subsonic:6.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D1EA39E-CFA6-4FCA-93A2-BA6938702E6B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}