CVE-2019-9094

{"id": "CVE-2019-9094", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-03-21T16:01:15.233", "references": [{"url": "https://github.com/humhub/humhub/blob/master/protected/humhub/docs/CHANGELOG.md", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/humhub/humhub/blob/master/protected/humhub/docs/CHANGELOG.md", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad Cross-Site Scripting (XSS) reflejado en /s/adada/cfiles/upload en Humhub 1.3.10 Community Edition. La entrada proporcionada por el usuario que contiene JavaScript en el nombre de usuario se devuelve en el c\u00f3digo JavaScript, lo que result\u00f3 en Cross-Site Scripting (XSS)."}], "lastModified": "2024-11-21T04:50:57.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:humhub:humhub:1.3.10:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C04BC2B4-71F0-4B34-8C5F-5A9B8CD27DE7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}