CVE-2020-19880

{"id": "CVE-2020-19880", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-08-24T15:15:13.347", "references": [{"url": "https://github.com/fragrant10/cve/tree/master/dbhcms1.2.0#4", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/fragrant10/cve/tree/master/dbhcms1.2.0#4", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users."}, {"lang": "es", "value": "DBHcms versi\u00f3n v1.2.0, presenta una vulnerabilidad de tipo xss almacenado, ya que no se presenta una funci\u00f3n htmlspecialchars en el formulario \"Name\" en el archivo dbhcms\\types.php. Un atacante no autenticado remoto puede explotar esta vulnerabilidad para secuestrar a otros usuarios."}], "lastModified": "2024-11-21T05:09:26.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dbhcms_project:dbhcms:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDAE8FC9-A3BC-4740-8008-FAE4B110F4FE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}