CVE-2018-13825

Опубликовано: 30 авг. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.

Ссылки

http://www.securityfocus.com/bid/105297
Third Party Advisory
VDB Entry
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105297
Third Party Advisory
VDB Entry
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:broadcom:project_portfolio_management:*:*:*:*:*:*:*:*

Версия до 14.3 (включая)

cpe:2.3:a:broadcom:project_portfolio_management:14.4:*:*:*:*:*:*:*

cpe:2.3:a:broadcom:project_portfolio_management:15.1:*:*:*:*:*:*:*

cpe:2.3:a:ca:project_portfolio_management:15.2:cp5:*:*:*:*:*:*

cpe:2.3:a:ca:project_portfolio_management:15.3:cp2:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00239

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-72wf-3vw4-gqvg