Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-19682

Опубликовано: 09 дек. 2019
Источник: nvd
CVSS3: 4.8
CVSS2: 3.5
EPSS Низкий

Описание

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:nopcommerce:nopcommerce:4.20:-:*:*:*:*:*:*

EPSS

Процентиль: 46%
0.00235
Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

github логотип

GHSA-q5q7-8cv7-gmcr

CVSS3: 4.8
github
больше 3 лет назад

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.

EPSS

Процентиль: 46%
0.00235
Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79