« Volver al listado

CVE-2019-18265

Estado: ModificadaMedia (5.4)—

Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Digitalalertsystems — Dasdec I FirmwareDigitalalertsystems — Dasdec II FirmwareDigitalalertsystems — Dasdec III FirmwareDigitalalertsystems — One-net FirmwareDigitalalertsystems — One-net SE Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18265",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-18265",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-16T15:49:22.287863Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Digital Alert Systems",
          "product": "DASDEC",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-11-30T23:15:09.957",
  "references": [
    {
      "url": "https://www.digitalalertsystems.com/security-advisory",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.digitalalertsystems.com/security-advisory",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application."
    },
    {
      "lang": "es",
      "value": "El software DASDEC de Digital Alert Systems anterior a la versión 4.1 contiene una vulnerabilidad de cross-site scripting (XSS) que permite a atacantes remotos inyectar scripts web o HTML de su elección a través del nombre de usuario SSH, el campo de nombre de usuario de la página de inicio de sesión o mediante el encabezado del host HTTP. El contenido inyectado se almacena en registros y se representa cuando se visualiza en la aplicación web."
    }
  ],
  "lastModified": "2026-06-17T02:24:43.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digitalalertsystems:dasdec_ii_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C540D23B-6FA9-4E99-88D9-61A744F4DA3F",
              "versionEndExcluding": "4.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digitalalertsystems:dasdec_ii:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DE615E7B-7927-4005-BD6E-A31F4DBD6ABC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digitalalertsystems:one-net_se_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C1A4076-F672-48A0-9F80-89A1F9317667",
              "versionEndExcluding": "4.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digitalalertsystems:one-net_se:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7FA3908B-1672-4986-A909-44EDF6A11051"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digitalalertsystems:dasdec_i_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6D78703-0DB2-476E-B6C0-DA62C067FB1E",
              "versionEndExcluding": "4.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digitalalertsystems:dasdec_i:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C704906A-0F64-46F3-9292-C71F4C35C0DA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digitalalertsystems:one-net_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "696C9170-BB44-4E63-A666-B1077AAE71BF",
              "versionEndExcluding": "4.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digitalalertsystems:one-net:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "407CA3A2-FDB1-45E5-85C5-4DE76D9C5AC4"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digitalalertsystems:dasdec_iii_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66EA2E11-B51B-4D14-8008-52F976C78368",
              "versionEndExcluding": "4.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digitalalertsystems:dasdec_iii:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E51CB83E-8B57-436D-9599-744B0C6EB91B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}