{"id": "CVE-2020-28968", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-22T20:15:11.020", "references": [{"url": "https://www.vulnerability-lab.com/get_content.php?id=2244", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2244", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field."}, {"lang": "es", "value": "Draytek VigorAP 1000C contiene una vulnerabilidad de tipo cross-site scripting (XSS) almacenada en el m\u00f3dulo RADIUS Setting - RADIUS Server Configuration. Esta vulnerabilidad permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga \u00fatil dise\u00f1ada en el campo de entrada username"}], "lastModified": "2024-11-21T05:23:23.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_1000c_firmware:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "742C6089-9E2E-4ECB-AF7E-5D9B894F9AED"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_1000c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E93E754E-F8F5-4E77-8ED1-BFA34C26C2F1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_700_firmware:1.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "159E7D7F-6753-4B9D-B68C-EBC8B103523C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_700:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "83567C7C-880E-4275-9146-A309C12272FE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_710_firmware:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57291C9F-03E6-471E-90AD-9EA3410386CA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_710:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "88458732-9951-41A4-8FF5-638E1C2849FE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_800_firmware:1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89196326-E450-49BD-B6A0-A4CD83F16051"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "83AA8C11-D451-4545-8B83-80CB2B20EBB5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_802_firmware:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE6F104E-1406-4167-A0C7-00CBF0E1DC9B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_802:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DAE5715D-BA12-43D8-913F-3F067DBAE9BF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_810_firmware:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3011DC89-E9B5-4359-8715-C9EAE5F5A63A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_810:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4093BE65-79DE-4920-AD37-B0A19E101993"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_900_firmware:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF25D657-6E0A-48FC-9218-ACF6BE1ABC6C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E891B2CB-6EB5-447B-A588-2CB1A99BF407"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_902_firmware:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1023654B-CDFD-485A-92B5-37BD9AAE023E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_902:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E8BCD733-094A-42DC-BFFC-C0D77EF5B91F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:1.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB11C0E7-D52A-4ED2-8F0F-C5D418BE5046"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_903:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D793F78F-1A6C-47AC-9F17-877DA0C6DD7D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_910c_firmware:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6701321-8DF1-4BCF-8BF8-BBFE78720D13"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_910c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B2DE2DE3-EB97-45F2-87EF-B7F2B72F036B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B4544C4-4C80-4227-ADFC-24638764CAE6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_912c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F2052075-C2C4-4462-96B7-E3C448B81AD7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9362C3C6-94A7-49EC-AA3F-CDA1F319366F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_918r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "257B6270-8551-4E08-8A04-E8D575407EE0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_920r_firmware:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A824F6F-744D-4E6A-8319-5615827478DF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigorap_920r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B9CAC188-1AA6-4158-89FE-42D4680F7A02"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}
