« Volver al listado

CVE-2019-8279

Estado: ModificadaMedia (5.4)—

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vanillaforums — Vanilla Forums

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-8279",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@kaspersky.com",
      "affectedData": [
        {
          "vendor": "Kaspersky Lab",
          "product": "Vanilla Forums",
          "versions": [
            {
              "status": "affected",
              "version": "Before 2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-02T01:29:00.357",
  "references": [
    {
      "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum."
    },
    {
      "lang": "es",
      "value": "Múltiples Cross-Site Scripting (XSS) persistentes en Vanilla Forums, en versiones anteriores a la 2.5, permiten que los atacantes remotos inyecten código JavaScript arbitrario en cualquier mensaje del foro."
    }
  ],
  "lastModified": "2026-06-17T02:41:48.123",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E55B7050-8F53-4CDB-AE0B-68728D92AEC3",
              "versionEndExcluding": "2.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com"
}