CVE-2018-17256

{"id": "CVE-2018-17256", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-11-27T19:29:00.197", "references": [{"url": "https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html", "tags": ["Third Party Advisory"], "source": "vulnerability@cspcert.ph"}, {"url": "https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content."}, {"lang": "es", "value": "Vulnerabilidad Cross-Site Scripting (XSS) persistente en Umbraco CMS 7.12.3 permite que usuarios autenticados inyecten scripts web arbitrarios mediante el nombre de cabecera de un contenido (Blog, Content Page, etc.). La vulnerabilidad se explota al actualizar o eliminar el acceso p\u00fablico a un contenido."}], "lastModified": "2024-11-21T03:54:09.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_cms:7.12.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ACB8626-6DD7-4CDE-8789-7E6E3BE6BC20"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@cspcert.ph"}