« Volver al listado

CVE-2020-29145

Estado: ModificadaMedia (5.4)—

In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Ericsson — Bscs IX R18 Billing & Rating AdmxEricsson — Bscs IX R18 Billing & Rating MX

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-29145",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-27T04:15:10.307",
  "references": [
    {
      "url": "http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework."
    },
    {
      "lang": "es",
      "value": "En Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX es un módulo de base web en BSCS iX que es vulnerable a un ataque de tipo XSS almacenado por medio del campo name o description en un Access Rights Group de solutionUnitServlet?SuName=UserReferenceDataSU. En la mayoría de los casos de prueba, el secuestro de sesiones también fue posible usando una vulnerabilidad de tipo XSS. Esto potencialmente permite la toma de control total de la cuenta o la explotación de los navegadores de los administradores mediante el uso del framework beef"
    }
  ],
  "lastModified": "2026-06-17T03:11:05.553",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ericsson:bscs_ix_r18_billing_\\&_rating_admx:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63CC94DB-B085-460F-99DF-6F70AA2400F5"
            },
            {
              "criteria": "cpe:2.3:a:ericsson:bscs_ix_r18_billing_\\&_rating_mx:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28A2EF02-A725-4C31-B5B4-8B6D88E6497D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}