CVE-2020-13992

{"id": "CVE-2020-13992", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-07-09T15:15:12.397", "references": [{"url": "https://loca1gh0s7.github.io/MFH-from-XSS-to-RCE-loca1gh0st-exercise", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://loca1gh0s7.github.io/MFH-from-XSS-to-RCE-loca1gh0st-exercise", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Mods para HESK versiones 3.1.0 hasta 2019.1.0. Un problema de tipo XSS almacenado permite a atacantes no autenticados remotos abusar de la sesi\u00f3n iniciada por un usuario del helpdesk. Un usuario con privilegios suficientes para cambiar su imagen de la p\u00e1gina de inicio de sesi\u00f3n debe abrir un ticket dise\u00f1ado"}], "lastModified": "2024-11-21T05:02:18.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mods-for-hesk:mods_for_hesk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2A3FF3E-0097-4456-B329-E4A61C59A090", "versionEndIncluding": "2019.1.0", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}