« Volver al listado

CVE-2019-3490

Estado: ModificadaMedia (6.1)—

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Open Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-3490",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "OES",
          "product": "Netstorage component of Open Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "version": "OES2015SP1"
            },
            {
              "status": "affected",
              "version": "OES2018"
            },
            {
              "status": "affected",
              "version": "and OES2018SP1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-05-02T17:29:02.787",
  "references": [
    {
      "url": "https://support.microfocus.com/kb/doc.php?id=7023828",
      "source": "security@opentext.com"
    },
    {
      "url": "https://support.microfocus.com/kb/doc.php?id=7023828",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support."
    },
    {
      "lang": "es",
      "value": "Se identificó una vulnerabilidad de  tipo XSS basada en DOM en el componente Netstorage de Open Enterprise Server (OES) que permite a un atacante remoto ejecutar javascript en el navegador de víctimas engañando al usuario para que haga clic en un enlace especialmente creado. Esto afecta a las versiones de OES OES2015SP1, OES2018 y OES2018SP1. Las versiones anteriores pueden verse afectadas pero no fueron puestos a prueba porque están fuera de soporte."
    }
  ],
  "lastModified": "2026-06-17T02:35:11.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:open_enterprise_server:2015.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDB22E89-A592-4FA4-B698-D0261B22632C"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:open_enterprise_server:2018.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F8C3F4B-53D9-49BF-9032-47AB0839200D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:open_enterprise_server:2018.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8D62BB5-DF16-4705-97B4-034D6C6342A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}