CVE-2020-20285

{"id": "CVE-2020-20285", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2020-12-18T19:15:14.157", "references": [{"url": "https://github.com/iohex/ZZCMS/blob/master/zzcms2019_login_xss.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php"}, {"lang": "es", "value": "Se presenta un ataque de tipo XSS en la p\u00e1gina de inicio de sesi\u00f3n del usuario en zzcms 2019. Los usuarios pueden inyectar c\u00f3digo js mediante el encabezado referer por medio del archivo user/login.php"}], "lastModified": "2020-12-22T18:40:46.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zzcms:zzcms:2019:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5CA483C-9AA7-4EF9-B3D1-64AB6EC41BA0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}