CVE Vulnerability

CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

9 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://applied-risk.com/resources/ar-2019-007 Third Party Advisory
https://applied-risk.com/labs/advisories Not Applicable Third Party Advisory
https://applied-risk.com/index.php/download_file/view/199/165 Broken Link
https://www.us-cert.gov/ics/advisories/icsa-19-211-02 Third Party Advisory US Government Resource
http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:primasystems:flexair:*:*:*:*:*:*:*:*
Information

Published : 2019-06-05 07:29

Updated : 2022-10-25 03:39

NVD link : CVE-2019-7671

Mitre link : CVE-2019-7671

Products Affected
No products.
CWE
CWE-79