CVE-2018-11450

{"id": "CVE-2018-11450", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-07-09T20:29:00.910", "references": [{"url": "https://github.com/LucvanDonk/Siemens-Siemens-PLM-Software-TEAMCENTER-Reflected-Cross-Site-Scripting-XSS-vulnerability/wiki", "tags": ["Exploit", "Third Party Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Siemens PLM Software TEAMCENTER (V9.1.2.5). Si un usuario visita el portal de inicio de sesi\u00f3n mediante la URL manipulada por el atacante, el atacante puede insertar HTML/JavaScript y alterar o rescribir la p\u00e1gina del portal de inicio de sesi\u00f3n. Siemens PLM Software TEAMCENTER V9.1.3 y posteriores no se ha visto afectado."}], "lastModified": "2019-10-09T23:33:31.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:teamcenter_product_lifecycle_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFE57523-DDC8-41EF-9E81-9AFDDED49BC3", "versionEndIncluding": "9.1.2.5"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}