CVE Vulnerability

CVE-2019-1010147

Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://drive.google.com/open?id=1sk5IklziyEggeWpWE4Wyk9xqa30CjNpS Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:yellowfinbi:yellowfin_bi:*:*:*:*:*:*:*:*
cpe:2.3:a:bmc:remedy_smart_reporting:-:*:*:*:*:*:*:*
Information

Published : 2019-07-26 12:15

Updated : 2019-08-05 01:26

NVD link : CVE-2019-1010147

Mitre link : CVE-2019-1010147

Products Affected
No products.
CWE
CWE-79