« Volver al listado

CVE-2026-9056

Estado: AplazadaMedia (5.4)—

A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Talend — Administration CenterAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-9056",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9056",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-20T13:08:26.585632Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "4ac701fe-44e9-4bcd-9585-dd6449257611",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "4ac701fe-44e9-4bcd-9585-dd6449257611",
      "affectedData": [
        {
          "vendor": "Talend",
          "product": "Talend Administration Center",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "lessThan": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-20T05:16:23.350",
  "references": [
    {
      "url": "https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-cross-site/ta-p/2548522",
      "source": "4ac701fe-44e9-4bcd-9585-dd6449257611"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting almacenado ha sido encontrada en el Talend Administration Center. Un atacante con permiso para gestionar servidores puede almacenar una carga útil de XSS que puede ser activada por un usuario diferente."
    }
  ],
  "lastModified": "2026-07-23T20:10:00.130",
  "sourceIdentifier": "4ac701fe-44e9-4bcd-9585-dd6449257611"
}