CVE-2022-24985

{"id": "CVE-2022-24985", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-02-16T22:15:08.077", "references": [{"url": "https://JQueryForm.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.nou-systems.com/cyber-security", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server."}, {"lang": "es", "value": "Los formularios generados por JQueryForm.com versiones anteriores a 05-02-2022, permiten a un atacante remoto autenticado omitir la autenticaci\u00f3n y acceder a la secci\u00f3n administrativa de otros formularios alojados en el mismo servidor web. Esto es relevante s\u00f3lo cuando una organizaci\u00f3n aloja m\u00e1s de uno de estos formularios en su servidor"}], "lastModified": "2023-08-08T14:21:49.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jqueryform:jqueryform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97DCAD44-8B31-44EB-BA9E-13DF316AD174", "versionEndExcluding": "2022-02-05"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}