CVE Vulnerability

CVE-2019-11643

Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScript into textboxes decorated with type string, which is subsequently stored to the applicable data store. This can be exploited remotely by both authenticated and unauthenticated users.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://oneshield.com/business-solutions/oneshield-pc-solutions/oneshield-policy/ Product
http://seclists.org/fulldisclosure/2019/May/2 Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:oneshield:oneshield_policy:*:*:*:*:*:*:*:*
Information

Published : 2019-05-08 04:29

Updated : 2019-05-08 08:15

NVD link : CVE-2019-11643

Mitre link : CVE-2019-11643

Products Affected
No products.
CWE
CWE-79