CVE-2021-32019

{"id": "CVE-2021-32019", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-08-02T21:15:08.380", "references": [{"url": "https://openwrt.org/advisory/2021-08-01-1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://openwrt.org/advisory/2021-08-01-1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP."}, {"lang": "es", "value": "Se presenta una falta de comprobaci\u00f3n de entrada de los nombres de host mostrados en OpenWrt antes de la versi\u00f3n 19.07.8. La p\u00e1gina de Estado de la Conexi\u00f3n de la interfaz web de luci permite un ataque de tipo XSS, que puede usarse para obtener el control total del sistema afectado por medio de ICMP"}], "lastModified": "2024-11-21T06:06:43.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAA31F44-23DE-4031-A8CE-5AF198575220", "versionEndExcluding": "19.07.8", "versionStartIncluding": "19.07.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}