CVE-2021-3333

{"id": "CVE-2021-3333", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-02-05T14:15:19.310", "references": [{"url": "https://community.opmantek.com/display/OA/Errata+-+4.0.1+XSS+in+SQL+debugging+output", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://community.opmantek.com/display/OA/Errata+-+4.0.1+XSS+in+SQL+debugging+output", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link."}, {"lang": "es", "value": "Opmantek Open-AudIT versi\u00f3n 4.0.1, est\u00e1 afectado por una vulnerabilidad de tipo cross-site scripting. Al generar sentencias SQL para depuraci\u00f3n, una consulta dise\u00f1ada con fines maliciosos puede desencadenar un ataque de tipo XSS. Este ataque solo tiene \u00e9xito si el usuario ya hab\u00eda iniciado sesi\u00f3n en Open-AudIT antes de hacer clic en el enlace malicioso"}], "lastModified": "2024-11-21T06:21:19.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opmantek:open-audit:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EB5AED4-3D7E-4F43-965B-A172340A956A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}