« Volver al listado

CVE-2019-9230

Estado: ModificadaMedia (6.1)—

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting (XSS) vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Audiocodes — Mediant 500-mbsr FirmwareAudiocodes — Mediant 500l-msbr FirmwareAudiocodes — Mediant 800c-msbr FirmwareAudiocodes — Mediant M800b-msbr Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-9230",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-18T15:15:11.523",
  "references": [
    {
      "url": "https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting (XSS) vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script or HTML via the keyword parameter."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en los dispositivos AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR y 800C-MSBR con versiones de firmware F7.20A a F7.20A.253. Una vulnerabilidad de los scripts entre sitios (XSS) en la función de búsqueda de la interfaz web de administración permite a los atacantes remotos inyectar scripts web o HTML a través del parámetro de palabra clave."
    }
  ],
  "lastModified": "2026-06-17T02:43:24.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:audiocodes:mediant_500l-msbr_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06E7C8AE-B6F5-4257-9C60-3626B540A3D1",
              "versionEndIncluding": "f7.20a.253",
              "versionStartIncluding": "f7.20a"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:audiocodes:mediant_500l-msbr:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C63D6D5E-5FDC-48D0-BB8A-5828241D2DB1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:audiocodes:mediant_500-mbsr_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "877EDC8C-B847-4257-8786-3F40078B40E7",
              "versionEndIncluding": "f7.20a.253",
              "versionStartIncluding": "f7.20a"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:audiocodes:mediant_500-mbsr:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "449C4C26-69EE-451C-B6DB-4A2C763AB4DF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:audiocodes:mediant_m800b-msbr_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF18428D-5EC4-4CC9-BFE1-BC7391AEE2BA",
              "versionEndIncluding": "f7.20a.253",
              "versionStartIncluding": "f7.20a"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:audiocodes:mediant_m800b-msbr:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B45E7C7F-AA75-4D7B-9883-904E875E84F7"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:audiocodes:mediant_800c-msbr_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EB66227-D073-40B8-AC87-CB33B68ED552",
              "versionEndIncluding": "f7.20a.253",
              "versionStartIncluding": "f7.20a"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:audiocodes:mediant_800c-msbr:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "77BE21C6-50FB-45AB-8D10-6ED83053BB0E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}