CVE-2018-20322

{"id": "CVE-2018-20322", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-12-21T23:29:00.933", "references": [{"url": "https://bugs.limesurvey.org/view.php?id=14376", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.limesurvey.org/view.php?id=14376", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6."}, {"lang": "es", "value": "LimeSurvey, en su versi\u00f3n 3.15.5, contiene una vulnerabilidad de Cross Site Scripting (XSS) en la subida del zip \"Survey Resource\" que puede resultar en la ejecuci\u00f3n de c\u00f3digo JavaScript contra los administradores de LimeSurvey. Esto se solucion\u00f3 en la versi\u00f3n 3.15.6."}], "lastModified": "2024-11-21T04:01:13.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0D5F867-EDEA-4930-B1F2-57FFBCDE2F14", "versionEndIncluding": "3.15.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}