CVE-2010-0971

{"id": "CVE-2010-0971", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-03-16T19:00:00.680", "references": [{"url": "http://osvdb.org/62904", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/62905", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/62906", "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.org/1003-exploits/atutor-xss.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/38906", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/11685", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/38656", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56852", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type and (4) Title fields in tools/groups/create_manual.php, and the (5) Title field in assignments/add_assignment.php. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en ATutor v1.6.4 permite a usuarios autentificados remotamente, con privilegios de Instructor, inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9s de los campos (1) Question y(2) Choice en tools/polls/add.php, los campos(3) Type y (4) Title en tools/groups/create_manual.php; y el campo (5) Title en assignments/add_assignment.php"}], "lastModified": "2017-08-17T01:32:11.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atutor:atutor:1.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DD19A48-FC2A-406C-8299-60E87269451F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}