CVE-2021-41557

{"id": "CVE-2021-41557", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-12-15T07:15:07.273", "references": [{"url": "http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.sofico.global", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number."}, {"lang": "es", "value": "Sofico Miles RIA 2020.2 versi\u00f3n Build 127964T est\u00e1 afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) Almacenado. Un atacante con acceso a una cuenta de usuario del rol RIA IT o Fleet puede crear una orden de trabajo dise\u00f1ada en la secci\u00f3n de informes de da\u00f1os (o modificar \u00f3rdenes de trabajo existentes). El payload de tipo XSS est\u00e1 en el n\u00famero de la orden de trabajo"}], "lastModified": "2021-12-17T20:42:35.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sofico:miles_rich_internet_application:2020.2:build_127964t:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EE8B664-057B-4288-B5D9-539417DBC16F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}