Lucene search

MitreCVE-2019-9725

HistoryMar 12, 2019 - 8:29 p.m.

CVE-2019-9725

2019-03-1220:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2019-9725

web manager

korenix jetport

persistent xss

port alias field

serial setting

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.

Affected configurations

Nvd

Node

korenixjetport_web_managerMatch-

Node

korenixjetport_5601_firmwareMatch-

AND

korenixjetport_5601Match-

Node

korenixjetport_5601f_firmwareMatch-

AND

korenixjetport_5601fMatch-

VendorProductVersionCPE
korenixjetport_web_manager-cpe:2.3:a:korenix:jetport_web_manager:-:*:*:*:*:*:*:*
korenixjetport_5601_firmware-cpe:2.3:o:korenix:jetport_5601_firmware:-:*:*:*:*:*:*:*
korenixjetport_5601-cpe:2.3:h:korenix:jetport_5601:-:*:*:*:*:*:*:*
korenixjetport_5601f_firmware-cpe:2.3:o:korenix:jetport_5601f_firmware:-:*:*:*:*:*:*:*
korenixjetport_5601f-cpe:2.3:h:korenix:jetport_5601f:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
korenix	jetport_web_manager	-	cpe:2.3:a:korenix:jetport_web_manager:-:::::::*
korenix	jetport_5601_firmware	-	cpe:2.3:o:korenix:jetport_5601_firmware:-:::::::*
korenix	jetport_5601	-	cpe:2.3:h:korenix:jetport_5601:-:::::::*
korenix	jetport_5601f_firmware	-	cpe:2.3:o:korenix:jetport_5601f_firmware:-:::::::*
korenix	jetport_5601f	-	cpe:2.3:h:korenix:jetport_5601f:-:::::::*

References

medium.com/%40bertinjoseb/korenix-jetport-web-manager-persistent-xss-6cf7e2a38634

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

Related for CVE-2019-9725