CVE-2020-14988

{"id": "CVE-2020-14988", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-03-11T19:15:12.717", "references": [{"url": "https://tvrbk.github.io/cve/2021/03/09/brXM.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://tvrbk.github.io/cve/2021/03/09/brXM.html", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Bloomreach Experience Manager (brXM) versiones 4.1.0 hasta 14.2.2. Permite un ataque de tipo XSS en la p\u00e1gina de inicio de sesi\u00f3n por medio del par\u00e1metro loginmessage, el editor de texto por medio del atributo src de los elementos HTML, el men\u00fa de traducciones por medio del par\u00e1metro foldername, la p\u00e1gina de autor por medio de la URL del enlace o la funcionalidad de carga de imagen por medio de un documento SVG que contiene JavaScript"}], "lastModified": "2024-11-21T05:04:35.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bloomreach:experience_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A89A8A50-DA47-49F7-8317-CB0B197C1F48", "versionEndIncluding": "14.2.2", "versionStartIncluding": "14.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}