CVE-2018-1000813

{"id": "CVE-2018-1000813", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-12-20T15:29:00.440", "references": [{"url": "https://backdropcms.org/security/backdrop-sa-core-2018-005", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later."}, {"lang": "es", "value": "Backdrop CMS, en versiones 1.11.0 y anteriores, contiene una vulnerabilidad Cross-Site Scripting (XSS) en el saneamiento de nombres de clase personalizados empleados en bloques y distribuciones. Esto puede resultar en la ejecuci\u00f3n de JavaScript desde una fuente inesperada. El ataque parece ser explotable si un usuario se dirige a una p\u00e1gina afectada mientras se inicia sesi\u00f3n. La vulnerabilidad parece haber sido solucionada en las versiones 1.11.1 y siguientes."}], "lastModified": "2019-01-06T16:42:47.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD28229-EC69-42B2-AB6D-CBA61AA4B859", "versionEndIncluding": "1.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}