2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MegaBIP","vendor":"Jan Syski","versions":[{"lessThanOrEqual":"5.19","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. \nVersion 5.20 of MegaBIP fixes this issue."},{"lang":"es","value":"El editor de texto integrado en el software MegaBIP no neutraliza la entrada del usuario, lo que permite ataques XSS almacenado contra otros usuarios. Para usar el editor se requieren privilegios elevados. La versión 5.20 de MegaBIP soluciona este problema."}],"id":"CVE-2025-3894","lastModified":"2026-06-17T09:20:52.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-23T12:12:06.436083Z","version":"2.0.3"}}]},"published":"2025-05-23T11:15:32.820","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2025/05/CVE-2025-3893"},{"source":"cvd@cert.pl","url":"https://megabip.pl/index.php?id=24,145"},{"source":"cvd@cert.pl","url":"https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Secondary"}]}
|