CVE-2019-17120
Estado: ModificadaMedia (6.1)—
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 49%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
- http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
- http://seclists.org/fulldisclosure/2019/Oct/35
- https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting
- http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
- http://seclists.org/fulldisclosure/2019/Oct/35
- https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-17120",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-10-17T19:15:10.937",
"references": [
{
"url": "http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2019/Oct/35",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2019/Oct/35",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) almacenado y reflejado en WiKID 2FA Enterprise Server versiones hasta 4.2.0-b2047, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del archivo /WiKIDAdmin/adm_usrs.jsp. El parámetro usr es vulnerable: a que ocurra un ataque de tipo cross-site scripting reflejado inmediatamente después de que el usuario es creado. El script malicioso es almacenado y será ejecutado siempre que sea visitado el archivo /WiKIDAdmin/adm_usrs.jsp."
}
],
"lastModified": "2026-06-17T02:23:21.010",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.81:b676:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4753C348-0E95-42C1-9046-A6F0A925BFA0"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.85:b780:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "742AF05F-BDFC-4B5D-B7C2-16EBB12423EC"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1092:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A8A4B86-C166-41BF-91F8-3A0E5935DFE4"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1159:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F0AD527-F28E-4D31-B3E4-164E50C7AE57"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1169:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3700CDE8-3E6F-45BB-ABAF-F39F47421114"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1216:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9895837A-1172-4033-A431-77F959E742AA"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b824:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF2A28EA-E801-4E48-9C7C-7F2338D601B9"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b839:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6061A10-388F-43F1-A60B-E05BFB8D9ADB"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1342:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1639C27B-E99D-4E4C-8359-BF1DAA540077"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1352:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D35F177D-13EB-4BF8-85D6-96D311A1F393"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1359:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80491F52-2BB1-4CA6-B029-773D7648D618"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1373:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A640A1D2-F902-48CD-A5CF-431254B9A4B1"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1403:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E9584C7-368F-40CB-9424-3C7D3206A9EE"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1411:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "203D7585-27A1-4F82-89ED-2B7B266C18D3"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1421:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F9CAFF9-F38C-4598-BE10-C9B4BDCEFB20"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1428:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC4359FB-27A1-445D-9C6D-F179E67A59E2"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1438:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC403DA6-072D-4DC2-9EB0-2CE79BF581AB"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1472:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38944F12-D0AD-460D-8057-9DE11B0FD511"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1542:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB04F7A6-77BD-4810-83E4-6F82EA0EFB62"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1580:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4F8E828-9BCE-4E5D-95F2-A3636D6158F5"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1659:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5674FE03-7B90-4F49-B7F9-A8ADBF25FC00"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1672:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "284197BB-7B78-425B-8410-5C3717749B5C"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1787:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A74FCAD-E081-4FF1-B49D-A542197A25FE"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1798:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE459BA2-3B76-4A4E-BEAD-10B21EB6D5F1"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1803:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E6CF12D-F364-42EC-94F4-D168B9B7AE34"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1817:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51FBB683-6236-4AF4-8BC9-45E445B05065"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1821:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA967277-B0F1-4D91-9FE5-5DC6718E8B5F"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1905:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68E22857-BEA7-4C36-B044-3B1CF70CDB37"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1906:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EE7F837-AB7C-4743-8380-A479ADC8B9E2"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1917:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C873DAC-3CDE-439B-B337-94C5C1589DF1"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1921:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21E0DC7C-D1E6-4836-A367-0E00AA82F208"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1926:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74586937-9BF8-4D5A-AD5F-131DE95CB4CA"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1941:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F519574C-6A12-4469-8A66-91CEA680CD70"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1949:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE822EC3-D06E-42A6-A6B6-28B1F1A73831"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1955:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23B9CEEC-EE7F-489E-B764-331263183CE6"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1978:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C77D0966-21EA-4DB3-8AE7-83F745FB7820"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1981:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D3B0A02-93F4-492D-810A-720448C624BB"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1984:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70ACC996-D417-48C9-9376-40AECBC0273C"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2007:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDA6CDF4-46F8-43F6-8843-61A05ADDD505"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2014:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D53E57B3-DFFB-448C-9610-463978C9E489"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2016:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E37F883-B939-4F6F-B20F-3ABB43BDBD1E"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2020:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20533E08-D4C3-42E5-8DE9-94F30710829A"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2023:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A13F872F-C8F2-49D4-9A05-49AA8DE3994E"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2028:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F03ADD91-7621-4314-A1DF-380CC51EBE0D"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2032:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D164551-F37A-4F3E-9868-C5CC2578144E"
},
{
"criteria": "cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2047:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "807A8ECD-CC2A-4141-B060-0C6FA65040F9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}