CVE-2019-13643

{"id": "CVE-2019-13643", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-07-18T03:15:10.137", "references": [{"url": "https://github.com/espocrm/espocrm/issues/1349", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/espocrm/espocrm/milestone/64?closed=1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page."}, {"lang": "es", "value": "Un problema de tipo XSS almacenado en EspoCRM anterior a versi\u00f3n 5.6.4, permite a los atacantes remotos ejecutar JavaScript malicioso e inyectar c\u00f3digo fuente arbitrario en las p\u00e1ginas de destino. El ataque inicia mediante el almacenamiento de un nuevo mensaje de flujo de datos que contiene una carga \u00fatil de tipo XSS. La carga \u00fatil almacenada puede ser activada haciendo clic en un enlace malicioso en la p\u00e1gina Notifications."}], "lastModified": "2019-07-23T16:43:02.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC38470D-6362-4909-9A9C-57AC9C352943", "versionEndExcluding": "5.6.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}