Lucene search

MitreCVE-2020-22723

HistoryNov 18, 2020 - 10:15 p.m.

CVE-2020-22723

2020-11-1822:15:11

CWE-79

mitre

web.nvd.nist.gov

security

vulnerability

xss

cross-site scripting

web script

html

beijing liangjing zhicheng technology co.

ltd ljcmsshop

cve-2020-22723

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.4%

JSON

A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address.

Affected configurations

Nvd

Node

ljcmsshop_projectljcmsshopMatch1.14

VendorProductVersionCPE
ljcmsshop_projectljcmsshop1.14cpe:2.3:a:ljcmsshop_project:ljcmsshop:1.14:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ljcmsshop_project	ljcmsshop	1.14	cpe:2.3:a:ljcmsshop_project:ljcmsshop:1.14:::::::*

References

baijiahao.baidu.com/s?id=1653681087434824406&wfr=spider&for=pc

www.freebuf.com/articles/web/192318.html

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.4%

JSON

Related for CVE-2020-22723