2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["PSA Web Application and PSA Desktop Client"],"product":"PSA","vendor":"ConnectWise","versions":[{"status":"affected","version":"All versions prior to 2026.1"}]}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*","matchCriteriaId":"CFB3E3A9-C554-4A40-9AB0-4881B9C30293","versionEndExcluding":"2026.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed."},{"lang":"es","value":"En versiones de ConnectWise PSA anteriores a 2026.1, las notas de entrada de tiempo almacenadas en la Pista de Auditoría de Entrada de Tiempo pueden ser renderizadas sin aplicar codificación de salida a cierto contenido. Bajo condiciones específicas, esto puede permitir que código de script almacenado se ejecute en el contexto del navegador de un usuario cuando el contenido afectado se muestra."}],"id":"CVE-2026-0695","lastModified":"2026-06-17T10:11:13.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0695","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-01-16T14:07:34.050146Z","version":"2.0.3"}}]},"published":"2026-01-16T14:15:54.793","references":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","tags":["Vendor Advisory"],"url":"https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"},{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","url":"https://www.themissinglink.com.au/security-advisories/cve-2026-0695"}],"sourceIdentifier":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"}]}
|