CVE-2018-6511
Vulnerability from cvelistv5
Published
2018-05-08 18:00
Modified
2024-09-16 20:32
Severity
Summary
XSS Vulnerability in Puppet Enterprise Console
References
Source | URL | Tags |
---|---|---|
security@puppet.com | https://puppet.com/security/cve/CVE-2018-6511 | Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
Puppet | Puppet Enterprise |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T06:10:10.180Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://puppet.com/security/cve/CVE-2018-6511" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Puppet Enterprise", "vendor": "Puppet", "versions": [ { "lessThan": "2017.3.6", "status": "affected", "version": "2017.3.x", "versionType": "custom" } ] } ], "datePublic": "2018-05-01T00:00:00", "descriptions": [ { "lang": "en", "value": "A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "description": "Cross-site scripting", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2018-05-08T17:57:01", "orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "puppet" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://puppet.com/security/cve/CVE-2018-6511" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS Vulnerability in Puppet Enterprise Console", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@puppet.com", "DATE_PUBLIC": "2018-05-01T13:00:00.000Z", "ID": "CVE-2018-6511", "STATE": "PUBLIC", "TITLE": "XSS Vulnerability in Puppet Enterprise Console" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Puppet Enterprise", "version": { "version_data": [ { "affected": "\u003c", "version_affected": "\u003c", "version_name": "2017.3.x", "version_value": "2017.3.6" } ] } } ] }, "vendor_name": "Puppet" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Cross-site scripting" } ] } ] }, "references": { "reference_data": [ { "name": "https://puppet.com/security/cve/CVE-2018-6511", "refsource": "CONFIRM", "url": "https://puppet.com/security/cve/CVE-2018-6511" } ] }, "source": { "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "assignerShortName": "puppet", "cveId": "CVE-2018-6511", "datePublished": "2018-05-08T18:00:00Z", "dateReserved": "2018-02-01T00:00:00", "dateUpdated": "2024-09-16T20:32:57.469Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-6511\",\"sourceIdentifier\":\"security@puppet.com\",\"published\":\"2018-05-08T18:29:00.483\",\"lastModified\":\"2022-04-12T18:31:36.790\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad Cross-Site Scripting (XSS) en Puppet Enterprise Console de Puppet Enterprise permite que un usuario inyecte scripts en Puppet Enterprise Console cuando se utiliza Puppet Enterprise Console. Las versiones de Puppet Puppet Enterprise afectadas son: versiones 2017.3.x anteriores al 2017.3.6.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV30\":[{\"source\":\"security@puppet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.5},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2017.3.6\",\"matchCriteriaId\":\"26538B44-C4F9-404A-9BF7-0DF291BEA5D5\"}]}]}],\"references\":[{\"url\":\"https://puppet.com/security/cve/CVE-2018-6511\",\"source\":\"security@puppet.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading...