2 lines
5.6 KiB
JSON
2 lines
5.6 KiB
JSON
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*"],"modules":["PluginController"],"product":"jshERP","vendor":"jishenghua","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"},{"status":"affected","version":"3.6"}]}],"source":"cna@vuldb.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*","matchCriteriaId":"2371BC75-D648-47F9-8B86-49CD53FB4DD4","versionEndIncluding":"3.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."},{"lang":"es","value":"Se identificó una vulnerabilidad en jishenghua jshERP hasta la versión 3.6. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /jshERP-boot/plugin/uploadPluginConfigFile del componente PluginController. Dicha manipulación del argumento configFile conduce a un salto de ruta. El ataque puede ser lanzado remotamente. El exploit está disponible públicamente y podría ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de incidencias pero aún no ha respondido."}],"id":"CVE-2026-1549","lastModified":"2026-06-17T10:16:03.073","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1549","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-29T15:58:46.085975Z","version":"2.0.3"}}]},"published":"2026-01-28T23:15:50.870","references":[{"source":"cna@vuldb.com","tags":["Product"],"url":"https://github.com/jishenghua/jshERP/"},{"source":"cna@vuldb.com","tags":["Exploit","Issue Tracking"],"url":"https://github.com/jishenghua/jshERP/issues/146"},{"source":"cna@vuldb.com","tags":["Exploit","Issue Tracking"],"url":"https://github.com/jishenghua/jshERP/issues/146#issue-3817997461"},{"source":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"],"url":"https://vuldb.com/?ctiid.343245"},{"source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"],"url":"https://vuldb.com/?id.343245"},{"source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"],"url":"https://vuldb.com/?submit.739805"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://github.com/jishenghua/jshERP/issues/146"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://github.com/jishenghua/jshERP/issues/146#issue-3817997461"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@vuldb.com","type":"Secondary"}]}
|