« Volver al listado

CVE-2019-7551

Estado: ModificadaCrítica (9)—

Cantemo Portal versión anterior a 3.2.13,versión 3.3.x anterior a 3.3.8 y versión 3.4.x anterior a 3.4.9 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) que al atacar esta vulnerabilidad permitiría realizar acciones como usuarios, incluidos los usuarios administrativos. Esto podría permitir la creación y eliminación de cuentas, así como la eliminación de la información contenida en la aplicación.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cantemo — Portal

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-7551",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-04-10T17:29:00.493",
  "references": [
    {
      "url": "https://blog-posts--cantemo.netlify.com/news/2019/03/cantemo-portal-xss-vulnerabilities/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://doc.cantemo.com/latest/ReleaseNotes/intro.html#version-3-4-9",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.bishopfox.com/blog/news-category/advisories/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog-posts--cantemo.netlify.com/news/2019/03/cantemo-portal-xss-vulnerabilities/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://doc.cantemo.com/latest/ReleaseNotes/intro.html#version-3-4-9",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.bishopfox.com/blog/news-category/advisories/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users, including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app."
    },
    {
      "lang": "es",
      "value": "Cantemo Portal versión anterior a 3.2.13,versión 3.3.x anterior a 3.3.8 y versión 3.4.x anterior a 3.4.9 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) que al atacar esta vulnerabilidad permitiría realizar acciones como usuarios, incluidos los usuarios administrativos. Esto podría permitir la creación y eliminación de cuentas, así como la eliminación de la información contenida en la aplicación."
    }
  ],
  "lastModified": "2026-06-17T02:40:41.337",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cantemo:portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76090BFE-5958-4BDA-ADAF-58570975CD9F",
              "versionEndExcluding": "3.2.13"
            },
            {
              "criteria": "cpe:2.3:a:cantemo:portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE344DDB-F67B-4CD0-BA47-1A4052F7F68C",
              "versionEndExcluding": "3.3.8",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:cantemo:portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E10FB80-AEA5-429A-8A74-486DF28463DF",
              "versionEndExcluding": "3.4.9",
              "versionStartIncluding": "3.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}