moappi Json2html Dok 1.1.x json2html.js Skriptovanje preko sajta

Identifikovana je ranjivost klasifikovana kao Problematiиno u moappi Json2html Dok 1.1.x. Obuhvaćeno je nepoznata funkcija u fajlu json2html.js. Promena uzrokuje Skriptovanje preko sajta. Korišćenjem CWE za opis problema dolazi se do CWE-79. Objava slabosti je izvršena 12/28/2022 kao 2d3d24d971b19a8ed1fb823596300b9835d55801. Izveštaj je dostupan za preuzimanje na github.com. Ova ranjivost je poznata pod oznakom CVE-2018-25053. Napad je moguće izvršiti sa udaljene lokacije. Napad zahteva pristup lokalnoj mreži. Tehnički podaci su dostupni. Нема доступног експлоита. U ovom trenutku, trenutna cena za eksploataciju može iznositi oko USD $0-$5k. Prema MITRE ATT&CK projektu, tehnika napada je T1059.007. Definisano je kao nije definisano. Kao 0-day, očekivana cena na crnom tržištu bila je oko $0-$5k. Prelaskom na verziju 1.2.0 ovaj problem može biti rešen. Ažuriranje je spremno za preuzimanje na github.com. Zakrpa se zove 2d3d24d971b19a8ed1fb823596300b9835d55801. Popravka je dostupna za preuzimanje na github.com. Preporučuje se da se nadogradi relevantna komponenta. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

3 Promene · 66 Tačke podataka

PoljeKreirali
12/28/2022 12:26		Ažurira 1/2
01/25/2023 16:00		Ažurira 2/2
01/25/2023 16:05
software_vendormoappimoappimoappi
software_nameJson2htmlJson2htmlJson2html
software_version<=1.1.x<=1.1.x<=1.1.x
software_filejson2html.jsjson2html.jsjson2html.js
vulnerability_cweCWE-79 (Skriptovanje preko sajta)CWE-79 (Skriptovanje preko sajta)CWE-79 (Skriptovanje preko sajta)
vulnerability_risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iLLL
cvss3_vuldb_aNNN
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
advisory_identifier2d3d24d971b19a8ed1fb823596300b9835d558012d3d24d971b19a8ed1fb823596300b9835d558012d3d24d971b19a8ed1fb823596300b9835d55801
advisory_urlhttps://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801https://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801https://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801
countermeasure_nameNadogradnjuNadogradnjuNadogradnju
upgrade_version1.2.01.2.01.2.0
countermeasure_upgrade_urlhttps://github.com/moappi/json2html/releases/tag/1.2.0https://github.com/moappi/json2html/releases/tag/1.2.0https://github.com/moappi/json2html/releases/tag/1.2.0
patch_name2d3d24d971b19a8ed1fb823596300b9835d558012d3d24d971b19a8ed1fb823596300b9835d558012d3d24d971b19a8ed1fb823596300b9835d55801
countermeasure_patch_urlhttps://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801https://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801https://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801
source_cveCVE-2018-25053CVE-2018-25053CVE-2018-25053
cna_responsibleVulDBVulDBVulDB
advisory_date1672182000 (12/28/2022)1672182000 (12/28/2022)1672182000 (12/28/2022)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiPPP
cvss2_vuldb_aiNNN
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.05.05.0
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore4.34.34.3
cvss3_vuldb_tempscore4.14.14.1
cvss3_meta_basescore4.34.34.9
cvss3_meta_tempscore4.14.14.8
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1672182000 (12/28/2022)1672182000 (12/28/2022)
cve_nvd_summaryA vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959.A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiR
cvss3_nvd_sC
cvss3_nvd_cL
cvss3_nvd_iL
cvss3_nvd_aN
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prN
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iL
cvss3_cna_aN
cve_cnaVulDB
cvss3_nvd_basescore6.1
cvss3_cna_basescore4.3

◂ PrethodnePregledSledeжi ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!