6.1
CVE-2018-13825
- EPSS 0.9%
- Veröffentlicht 30.08.2018 14:29:01
- Zuletzt bearbeitet 21.11.2024 03:48:09
- Erkennungen
LoginInsufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Broadcom ≫ Project Portfolio Management Version <= 14.3
Broadcom ≫ Project Portfolio Management Version 14.4
Broadcom ≫ Project Portfolio Management Version 15.1
Ca ≫ Project Portfolio Management Version 15.2 Update cp5
Ca ≫ Project Portfolio Management Version 15.3 Update cp2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.9% | 0.549 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.1 | 2.8 | 2.7 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://www.securityfocus.com/bid/105297
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html