CVE-2020-9447

{"id": "CVE-2020-9447", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-02-28T16:15:11.087", "references": [{"url": "https://github.com/manolo/gwtupload/issues/32", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.coresecurity.com/advisories/gwtupload-xss-file-upload-functionality", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/manolo/gwtupload/issues/32", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.coresecurity.com/advisories/gwtupload-xss-file-upload-functionality", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a website, and perform other malicious activities like phishing or drive-by hacking."}, {"lang": "es", "value": "Hay una vulnerabilidad XSS (cross-site scripting) en GwtUpload 1.0.3 en la funcionalidad de carga de archivos. Alguien puede cargar un archivo con un nombre de archivo malicioso, que contiene c\u00f3digo JavaScript, lo que dar\u00eda como resultado XSS. Las secuencias de comandos entre sitios permiten a los atacantes robar datos, cambiar la apariencia de un sitio web y realizar otras actividades maliciosas como el phishing o el pirateo de dispositivos."}], "lastModified": "2024-11-21T05:40:39.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gwtupload_project:gwtupload:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83DF83B6-87E9-4C19-8616-59B0CE2A0364"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}