CVE-2019-18648

EPSS 0.32%
Veröffentlicht 14.11.2019 15:15:12
Zuletzt bearbeitet 21.11.2024 04:33:26
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Untangle ≫ Ng Firewall Version14.2.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.32%	0.547

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.8	1.7	2.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-18648

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-18648

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-18648

EUVD