« Volver al listado

CVE-2019-19394

Estado: ModificadaMedia (6.1)—

Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Northern.tech — Cfengine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-19394",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-16T19:15:22.510",
  "references": [
    {
      "url": "https://cfengine.com/company/blog-detail/cve-2019-19394-mission-portal-javascript-injection-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cfengine.com/company/blog-detail/cve-2019-19394-mission-portal-javascript-injection-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0."
    },
    {
      "lang": "es",
      "value": "Se encontró un problema en Arista EOS. Los paquetes ARP malformados específicos pueden impactar el software mediante el reenvío de paquetes VxLAN. Este problema se encuentra en el código EOS VxLAN de Arista, que puede permitir a los atacantes bloquear el agente VxlanSwFwd. Esto afecta a EOS versiones 4.21.8M y versiones por debajo en la serie 4.21.x, versiones 4.22.3M y versiones por debajo en la serie 4.22.x, versiones 4.23.1F versiones por debajo en la serie 4.23.x, y a todas las versiones en la serie de código 4.15, 4.16, 4.17, 4.18, 4.19, 4.20."
    }
  ],
  "lastModified": "2026-06-17T02:26:37.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:northern.tech:cfengine:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A31D444-B390-44D5-B6B4-47C061DF64F6",
              "versionEndExcluding": "3.10.7",
              "versionStartIncluding": "3.10.0"
            },
            {
              "criteria": "cpe:2.3:a:northern.tech:cfengine:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBA1BDFC-999E-4553-9C55-4B41B7274000",
              "versionEndExcluding": "3.12.3",
              "versionStartIncluding": "3.12.0"
            },
            {
              "criteria": "cpe:2.3:a:northern.tech:cfengine:3.7:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC77D82-EEBA-43E8-9A09-47E74AEF87B7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}