CVE-2020-28917

{"id": "CVE-2020-28917", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-11-18T09:15:11.867", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2020-019", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved."}, {"lang": "es", "value": "Se detect\u00f3 un problema en la extensi\u00f3n view_statistics (tambi\u00e9n se conoce como View frontend statistics) versiones anteriores a 2.0.1 para TYPO3. Guarda todos los datos GET y POST de las peticiones del frontend de TYPO3 en la base de datos. Dependiendo de las extensiones usadas en un sitio web de TYPO3, es posible que puedan ser guardados datos confidenciales (por ejemplo, contrase\u00f1as de texto sin cifrar si ext:felogin est\u00e1 instalado)"}], "lastModified": "2020-12-02T20:20:35.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:view_frontend_statistics_project:view_frontend_statistics:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "55176AF2-87EA-4F85-80E9-D0B86F571714", "versionEndExcluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}