2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*","matchCriteriaId":"A15BA1B9-CB9B-4E2C-B8BC-F056451DC57F","versionEndExcluding":"0.8.5","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*","matchCriteriaId":"AF58258C-9FE8-4363-939F-E08387AE1F22","versionEndExcluding":"0.9.3","versionStartIncluding":"0.9.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php)."},{"lang":"es","value":"Vulnerabilidad de Cross-Site Scripting (XSS) en Shaarli, en versiones anteriores a la 0.8.5 y las versiones 0.9.x anteriores a la 0.9.3 permite que atacantes remotos inyecten código arbitrario mediante el campo username del formulario de inicio de sesión (también conocido como el parámetro login en la función ban_canLogin en index.php)."}],"id":"CVE-2018-5249","lastModified":"2026-06-17T01:59:54.870","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-01-05T20:29:00.220","references":[{"source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/pull/1046"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"},{"source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/pull/1046"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"],"url":"https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|