CVE-2018-1000998

{"id": "CVE-2018-1000998", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-02-04T21:29:00.300", "references": [{"url": "https://www.kvakil.me/posts/cvsweb/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.kvakil.me/posts/cvsweb/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x."}, {"lang": "es", "value": "FreeBSD CVSweb, en versiones 2.x, contiene una vulnerabilidad Cross-Site Scripting (XSS) en todas las p\u00e1ginas que puede resultar en un impacto limitado: CVSweb es an\u00f3nimo y de solo lectura. Podr\u00eda impactar sobre otrtos sitios en el mismo dominio. Este ataque parece ser explotable mediante una v\u00edctima que cargue una URL especialmente manipulada. La vulnerabilidad parece haber sido solucionada en las versiones 3.x."}], "lastModified": "2024-11-21T03:40:36.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freebsd:cvsweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0DE9515-5AA9-4A18-8E0E-FB6BBC468647", "versionEndIncluding": "2.0.6", "versionStartIncluding": "2.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}