CVE-2020-25104

{"id": "CVE-2020-25104", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2020-09-03T15:15:11.830", "references": [{"url": "https://discussions.eramba.org/t/bug-security-vulnerabilities-not-serious/1650", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.com/gitlab-com/gl-security/disclosures/-/blob/master/005_eramba/eramba_persistent_xss.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension."}, {"lang": "es", "value": "eramba versi\u00f3n c2.8.1 y Enterprise versiones anteriores a e2.19.3, permiten un ataque de tipo XSS por medio de un nombre de archivo dise\u00f1ado para un archivo adjuntado en un objeto. Por ejemplo, el nombre de archivo presenta una carga \u00fatil XSS completa seguida de la extensi\u00f3n .png"}], "lastModified": "2020-09-10T19:04:59.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eramba:eramba:2.8.1:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C98D213C-64EC-484B-B9DC-6AB77B2EC587"}, {"criteria": "cpe:2.3:a:eramba:eramba:2.19.3:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "33C80342-8AF1-44CD-BB86-D5B7FDE44495"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}