2 lines
4.9 KiB
JSON
2 lines
4.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NVR301-04S2-P4","vendor":"Uniview","versions":[{"lessThan":"NVR-B3801.20.17.240507","status":"affected","version":"0","versionType":"custom"}]}],"source":"ics-cert@hq.dhs.gov"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:uniview:nvr301-04s2-p4_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"087BD43C-9237-4C7D-923E-0CFAA2A5E976","versionEndExcluding":"nvr-b3801.20.17.240507","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:uniview:nvr301-04s2-p4:-:*:*:*:*:*:*:*","matchCriteriaId":"5CD63D99-65D2-4E52-BFD4-10D317D941D9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained."},{"lang":"es","value":"Uniview NVR301-04S2-P4 es vulnerable al ataque de Cross-Site Scripting (XSS) reflejado. Un atacante podría enviar a un usuario una URL que, si se hace clic en ella, podría ejecutar JavaScript malicioso en su navegador. Esta vulnerabilidad también requiere autenticación antes de poder explotarse, por lo que el alcance y la gravedad son limitados. Además, aunque se ejecute JavaScript no se obtienen beneficios adicionales."}],"id":"CVE-2024-3850","lastModified":"2026-06-17T07:45:17.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"ics-cert@hq.dhs.gov","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-3850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-12T19:30:41.171743Z","version":"2.0.3"}}]},"published":"2024-06-10T17:16:33.080","references":[{"source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/r3naissance/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3850.yaml"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
|