CVE-2020-13697

{"id": "CVE-2020-13697", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-02-23T08:15:11.307", "references": [{"url": "https://github.com/NanoHttpd/nanohttpd", "tags": ["Product", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vdoo.com/advisories", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization."}, {"lang": "es", "value": "Se detect\u00f3 un problema en el archivo RouterNanoHTTPD.java en NanoHTTPD versiones hasta 2.3.1. La clase GeneralHandler implementa un manejador GET b\u00e1sico que imprime informaci\u00f3n de depuraci\u00f3n como una p\u00e1gina HTML. Cualquier servidor web que extienda esta clase sin implementar su propio manejador GET es vulnerable al ataque de tipo XSS reflejado, porque el manejador GET GeneralHandler imprime la entrada del usuario pasada por medio de la cadena de consulta sin ning\u00fan tipo de saneo"}], "lastModified": "2021-02-26T20:54:04.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nanohttpd:nanohttpd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DB794C4-3984-437E-8366-5693A399470B", "versionEndIncluding": "2.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}