Lucene search

MitreCVE-2019-7551

HistoryApr 10, 2019 - 5:29 p.m.

CVE-2019-7551

2019-04-1017:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2019-7551

cantemo portal

xss

vulnerability

administrative users

account creation

information security

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

51.3%

JSON

Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users, including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app.

Affected configurations

Nvd

Node

cantemoportalRange<3.2.13

cantemoportalRange3.3.0–3.3.8

cantemoportalRange3.4.0–3.4.9

VendorProductVersionCPE
cantemoportal*cpe:2.3:a:cantemo:portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cantemo	portal	*	cpe:2.3:a:cantemo:portal::::::::

References

blog-posts--cantemo.netlify.com/news/2019/03/cantemo-portal-xss-vulnerabilities/

doc.cantemo.com/latest/ReleaseNotes/intro.html#version-3-4-9

www.bishopfox.com/blog/news-category/advisories/

www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

51.3%

JSON

Related for CVE-2019-7551