CVE-2018-1155

{"id": "CVE-2018-1155", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-08-02T19:29:00.873", "references": [{"url": "http://www.securitytracker.com/id/1041431", "tags": ["VDB Entry", "Third Party Advisory"], "source": "vulnreport@tenable.com"}, {"url": "https://www.tenable.com/security/tns-2018-11", "tags": ["Patch", "Vendor Advisory"], "source": "vulnreport@tenable.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue."}, {"lang": "es", "value": "En SecurityCenter, en versiones anteriores a la 5.7.0, un problema de Cross-Site Scripting (XSS) podr\u00eda permitir que un atacante autenticado inyecte c\u00f3digo JavaScript en un par\u00e1metro image filename en el \u00e1rea de la funcionalidad Reports. Se han implementado t\u00e9cnicas de validaci\u00f3n de entradas correctamente actualizadas para corregir este problema."}], "lastModified": "2018-10-03T18:04:39.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C3DD11-31E9-4FDA-8EAF-C1D774F7A32F", "versionEndExcluding": "5.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}