CVE-2014-9021

{"id": "CVE-2014-9021", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-11-20T17:50:10.147", "references": [{"url": "http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/533931/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/70985", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98565", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en ZTE_ZXDSL 831 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, o (5) tr69cDebugEnable en la p\u00e1gina del cliente TR-069 (tr69cfg.cgi); el par\u00e1metro (6) timezone (sntpcfg.sntp); o el par\u00e1metro (7) hostname en una acci\u00f3n save (guardar) en la p\u00e1gina Quick Stats (psilan.cgi). NOTA: este problema fue separado (SPLIT) de CVE-2014-9020 por ADT1 debido a los diferentes productos y bases de c\u00f3digo afectados."}], "lastModified": "2018-10-09T19:54:54.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zteusa:zxdsl_831:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96BE7851-9178-40B0-BCE0-055FE0871078"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}