CVE-2019-13122

{"id": "CVE-2019-13122", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-07-10T17:15:12.227", "references": [{"url": "http://jk.ozlabs.org/projects/patchwork/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2019/07/05/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/getpatchwork/patchwork/commits/master", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/getpatchwork/patchwork/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html", "tags": ["Mailing List", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html", "tags": ["Mailing List", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix."}, {"lang": "es", "value": "Existe una vulnerabilidad de tipo Cross Site Scripting (XSS) en la etiqueta de plantilla utilizada para renderizar identificadores de mensajes en Patchwork versiones 1.1 hasta 2.1.x. Esto permite a un atacante insertar JavaScript o HTML hacia la p\u00e1gina de detalle del parche por medio de un correo electr\u00f3nico enviado hacia una lista de correo consumida por Patchwork. Esto afecta a la funci\u00f3n msgid en el archivo templatetags/patch.py. Patchwork versiones 2.1.4 y 2.0.4 contendr\u00e1n la correcci\u00f3n."}], "lastModified": "2019-07-16T16:48:49.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8678FB71-AAB7-4EC9-A6DF-CF84CECA0618", "versionEndExcluding": "2.0.4", "versionStartIncluding": "1.1"}, {"criteria": "cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BD9CF3A-385F-4EE3-8FE3-2E18E3432A61", "versionEndExcluding": "2.1.4", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:ozlabs:patchwork:2.1.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF61E1F9-98D2-49A2-9CA9-58640EFBB7EF"}, {"criteria": "cpe:2.3:a:ozlabs:patchwork:2.1.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA6BEA6A-D49C-49D6-A8E6-1F4EDC348724"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}