« Volver al listado

CVE-2019-1010113

Estado: ModificadaMedia (6.1)—

CLEditor versión 1.4.5 y anteriores de Premium Software, está afectado por: Cross Site Scripting (XSS). El impacto es: un atacante podría ser capaz de inyectar html y código script arbitrario en el sitio web. El componente es: el plugin jQuery. El vector de ataque es: la víctima debe abrir un atributo href diseñado de un elemento de enlace (A).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Premiumsoftware — Cleditor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-1010113",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "josh@bress.net",
      "affectedData": [
        {
          "vendor": "Premium Software",
          "product": "CLEditor",
          "versions": [
            {
              "status": "affected",
              "version": "≤ 1.4.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-19T16:15:12.180",
  "references": [
    {
      "url": "https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "josh@bress.net"
    },
    {
      "url": "https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element."
    },
    {
      "lang": "es",
      "value": "CLEditor versión 1.4.5 y anteriores de Premium Software,  está afectado por: Cross Site Scripting (XSS). El impacto es: un atacante podría ser capaz de inyectar html y código script arbitrario en el sitio web. El componente es: el plugin jQuery. El vector de ataque es: la víctima debe abrir un atributo href diseñado de un elemento de enlace (A)."
    }
  ],
  "lastModified": "2026-06-17T02:09:47.257",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:premiumsoftware:cleditor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91A4F1E2-04C8-4E7A-BE3C-FC14AA5EE045",
              "versionEndIncluding": "1.4.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "josh@bress.net"
}