CVE-2018-1000172

{"id": "CVE-2018-1000172", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-04-30T22:29:00.247", "references": [{"url": "https://fortiguard.com/zeroday/FG-VD-17-215", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://wordpress.org/plugins/nextgen-gallery/#developers", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://fortiguard.com/zeroday/FG-VD-17-215", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wordpress.org/plugins/nextgen-gallery/#developers", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45."}, {"lang": "es", "value": "Imagely NextGEN Gallery, en versiones 2.2.30 y anteriores, contiene una vulnerabilidad de Cross Site Scripting (XSS) en Image Alt Title Text. El ataque parece ser explotable si una v\u00edctima visualiza la imagen en la p\u00e1gina de administrador. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 2.2.45."}], "lastModified": "2024-11-21T03:39:50.783", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "CC941760-4EFB-4381-B4F4-7A71121A3982", "versionEndIncluding": "2.2.30"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}