CVE-2020-27262

{"id": "CVE-2020-27262", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-01-08T16:15:14.967", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Innokas Yhtym\u00e4 Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web interface."}, {"lang": "es", "value": "Innokas Yhtym\u00e4 Oy Vital Signs Monitor VC150 anterior a versi\u00f3n 1.7.15. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en los productos afectados que permiten a un atacante inyectar script web o HTML arbitrario por medio del par\u00e1metro filename en m\u00faltiples endpoints de actualizaci\u00f3n de la interfaz web administrativa"}], "lastModified": "2024-11-21T05:20:57.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:innokasmedical:vital_signs_monitor_vc150_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B12A592-BEC0-40A4-9121-D546391D039E", "versionEndExcluding": "1.7.15"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:innokasmedical:vital_signs_monitor_vc150:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B6319D79-50F3-4A2C-81DC-FF09E97656A9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}