CVE-2019-8404

{"id": "CVE-2019-8404", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2019-05-14T16:29:02.203", "references": [{"url": "http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://sourceforge.net/projects/webinessinventory/files/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/46405/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages."}, {"lang": "es", "value": "Se encontr\u00f3 un problema en Webiness Inventory versi\u00f3n 2.3. El componente ProductModel permite la carga arbitraria de archivos por medio de una imagen de producto dise\u00f1ada durante la creaci\u00f3n de un nuevo producto. En consecuencia, un atacante puede sustraer informaci\u00f3n del sitio con la ayuda de un archivo ejecutable instalado o cambiar el contenido de las p\u00e1ginas."}], "lastModified": "2019-05-22T20:17:05.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webiness_inventory_project:webiness_inventory:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B99A442-D9D4-4B1E-AAD4-F7DCBA0E1955"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}