CVE-2019-10845

{"id": "CVE-2019-10845", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-04-08T18:29:00.223", "references": [{"url": "http://packetstormsecurity.com/files/152452/Uniqkey-Password-Manager-1.14-Denial-Of-Service.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2019/Apr/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://vuldb.com/?id.132960", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product, a pop-up window will appear asking the user if they want to save these new credentials. The code of the pop-up window can be read and, to some extent, manipulated by remote servers. This pop-up window will stay on any page the user visits within the browser until a decision is made. A malicious web server can forcefully manipulate the pop-up and cause it not to appear, stopping users from securing their credentials. This vulnerability is related to id=\"uniqkey-password-popup\" and password-popup/popup.html, but is a different vulnerability than CVE-2019-10676."}, {"lang": "es", "value": "Se ha detectado un problema en Uniqkey Password Manager versi\u00f3n 1.14. Cuando se introducen nuevas credenciales en un sitio que no est\u00e1 registrado en este producto, aparecer\u00e1 una ventana emergente pregunt\u00e1ndole al usuario si desea guardar estas nuevas credenciales. El c\u00f3digo de la ventana emergente se puede leer y, en cierta medida, ser manipulado por los servidores remotos. Esta ventana emergente se alojar\u00e1 en cualquier p\u00e1gina que el usuario visite dentro del navegador hasta que una decisi\u00f3n se haya tomado. Un servidor Web malicioso puede manipular con fuerza la ventana emergente y hacer que no aparezca, impidiendo que los usuarios aseguren sus credenciales. Esta vulnerabilidad est\u00e1 relacionada con ID = \"uniqkey-password-popup\" y password-popup/popup.html, pero es una vulnerabilidad diferente de CVE-2019-10676."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uniqkey:password_manager:1.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37A0462E-58EB-41FA-8FBA-C8B2C1872530"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}