CVE-2021-3176

{"id": "CVE-2021-3176", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2021-01-29T07:15:18.810", "references": [{"url": "https://www.mitel.com/support/security-advisories", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0001", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view user information and application data."}, {"lang": "es", "value": "La ventana de chat de Mitel BusinessCTI Enterprise (MBC-E) Client para Windows versiones anteriores a 6.4.15 y versiones 7.x anteriores a 7.1.2, podr\u00eda permitir a un atacante conseguir acceso a la informaci\u00f3n del usuario mediante el env\u00edo de determinado c\u00f3digo, debido a una comprobaci\u00f3n inapropiada de la entrada de enlaces http. Un explotaci\u00f3n con \u00e9xito podr\u00eda permitir a un atacante visualizar la informaci\u00f3n del usuario y los datos de la aplicaci\u00f3n"}], "lastModified": "2021-02-05T15:58:33.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mitel:businesscti_enterprise:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "40E2A7CF-E26A-414F-8AAF-B63ACC283CBA", "versionEndExcluding": "6.4.15"}, {"criteria": "cpe:2.3:a:mitel:businesscti_enterprise:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "0C2684E9-3D2A-4622-95DA-DA67E23D7DFF", "versionEndExcluding": "7.1.2", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}