« Volver al listado

CVE-2013-4098

Estado: ModificadaMedia (5)—

ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

DS3 — Authentication Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4098",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-06-28T23:55:14.137",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/121862/DS3-Authentication-Server-Command-Execution.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter."
    },
    {
      "lang": "es",
      "value": "ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server permite a atacantes remotos inyectar texto de error-page de su elección a través del parámetro message."
    }
  ],
  "lastModified": "2026-06-16T23:56:37.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ds3:authentication_server:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D8AE1C8-96CD-4AF2-B579-17DB5B8E6803"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}