Lucene search

[email protected]NVD:CVE-2019-11595

HistoryApr 29, 2019 - 3:29 p.m.

CVE-2019-11595

2019-04-2915:29:00

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

Affected configurations

Nvd

Node

ublockoriginublock_originRange<0.9.5.15

VendorProductVersionCPE
ublockoriginublock_origin*cpe:2.3:a:ublockorigin:ublock_origin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ublockorigin	ublock_origin	*	cpe:2.3:a:ublockorigin:ublock_origin::::::::

References

armin.dev/blog/2019/04/adblock-plus-code-injection/

news.ycombinator.com/item?id=19666504

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

Related for NVD:CVE-2019-11595

cve1 prion1 cvelist1