forked from CVEProject/cvelist
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'Cisco_CVE-2019-1707' of https://github.com/CiscoPSIRT/c…
…velist into CiscoPSIRT-Cisco_CVE-2019
- Loading branch information
Showing
1 changed file
with
85 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,87 @@ | ||
| { | ||
| "CVE_data_meta" : { | ||
| "ASSIGNER" : "cve@mitre.org", | ||
| "ID" : "CVE-2019-1707", | ||
| "STATE" : "RESERVED" | ||
| }, | ||
| "data_format" : "MITRE", | ||
| "data_type" : "CVE", | ||
| "data_version" : "4.0", | ||
| "description" : { | ||
| "description_data" : [ | ||
| { | ||
| "lang" : "eng", | ||
| "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." | ||
| } | ||
| ] | ||
| } | ||
| "CVE_data_meta": { | ||
| "ASSIGNER": "psirt@cisco.com", | ||
| "DATE_PUBLIC": "2019-03-06T16:00:00-0800", | ||
| "ID": "CVE-2019-1707", | ||
| "STATE": "PUBLIC", | ||
| "TITLE": "Cisco DNA Center Access Contract Stored Cross-Site Scripting Vulnerability" | ||
| }, | ||
| "affects": { | ||
| "vendor": { | ||
| "vendor_data": [ | ||
| { | ||
| "product": { | ||
| "product_data": [ | ||
| { | ||
| "product_name": "Cisco Digital Network Architecture Center (DNA Center) ", | ||
| "version": { | ||
| "version_data": [ | ||
| { | ||
| "affected": "<", | ||
| "version_value": "1.2.5" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "vendor_name": "Cisco" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "data_format": "MITRE", | ||
| "data_type": "CVE", | ||
| "data_version": "4.0", | ||
| "description": { | ||
| "description_data": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "A vulnerability in the web-based management interface of Cisco DNA Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco DNA Center versions prior to 1.2.5 are affected." | ||
| } | ||
| ] | ||
| }, | ||
| "exploit": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. " | ||
| } | ||
| ], | ||
| "impact": { | ||
| "cvss": { | ||
| "baseScore": "5.4", | ||
| "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N ", | ||
| "version": "3.0" | ||
| } | ||
| }, | ||
| "problemtype": { | ||
| "problemtype_data": [ | ||
| { | ||
| "description": [ | ||
| { | ||
| "lang": "eng", | ||
| "value": "CWE-79" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "references": { | ||
| "reference_data": [ | ||
| { | ||
| "name": "20190306 Cisco DNA Center Access Contract Stored Cross-Site Scripting Vulnerability", | ||
| "refsource": "CISCO", | ||
| "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-dna-xss" | ||
| } | ||
| ] | ||
| }, | ||
| "source": { | ||
| "advisory": "cisco-sa-20190306-dna-xss", | ||
| "defect": [ | ||
| [ | ||
| "CSCvk51466" | ||
| ] | ||
| ], | ||
| "discovery": "INTERNAL" | ||
| } | ||
| } |