CVE-2019-18265 - OpenCVE

Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Digitalalertsystems	Dasdec I Dasdec I Firmware Dasdec Ii Dasdec Ii Firmware Dasdec Iii Dasdec Iii Firmware One-net One-net Firmware One-net Se One-net Se Firmware

Configuration 1 [-]

AND

cpe:2.3:o:digitalalertsystems:dasdec_ii_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_ii:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:digitalalertsystems:one-net_se_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:one-net_se:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:digitalalertsystems:dasdec_i_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_i:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:digitalalertsystems:one-net_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:one-net:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:digitalalertsystems:dasdec_iii_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_iii:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.digitalalertsystems.com/security-advisory

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-11-30T22:58:26.586Z

Updated: 2024-08-05T01:47:14.156Z

Reserved: 2019-10-22T00:00:00.000Z

Link: CVE-2019-18265

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-11-30T23:15:09.957

Modified: 2022-12-09T00:44:47.127

Link: CVE-2019-18265

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2019-18265", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "requesterUserId": "b10c23db-d69c-4177-8d87-267a354894ff", "dateReserved": "2019-10-22T00:00:00.000Z", "datePublished": "2022-11-30T22:58:26.586Z", "dateUpdated": "2024-08-05T01:47:14.156Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DASDEC", "vendor": "Digital Alert Systems", "versions": [{"lessThan": "4.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Ken Pyle"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Digital Alert Systems\u2019 DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application."}], "value": "Digital Alert Systems\u2019 DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-11-30T23:36:29.454Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.digitalalertsystems.com/security-advisory"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:47:14.156Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.digitalalertsystems.com/security-advisory"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_ii_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C540D23B-6FA9-4E99-88D9-61A744F4DA3F", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_ii:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE615E7B-7927-4005-BD6E-A31F4DBD6ABC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:one-net_se_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C1A4076-F672-48A0-9F80-89A1F9317667", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:one-net_se:-:*:*:*:*:*:*:*", "matchCriteriaId": "7FA3908B-1672-4986-A909-44EDF6A11051", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_i_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6D78703-0DB2-476E-B6C0-DA62C067FB1E", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_i:-:*:*:*:*:*:*:*", "matchCriteriaId": "C704906A-0F64-46F3-9292-C71F4C35C0DA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:one-net_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "696C9170-BB44-4E63-A666-B1077AAE71BF", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:one-net:-:*:*:*:*:*:*:*", "matchCriteriaId": "407CA3A2-FDB1-45E5-85C5-4DE76D9C5AC4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_iii_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "66EA2E11-B51B-4D14-8008-52F976C78368", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_iii:-:*:*:*:*:*:*:*", "matchCriteriaId": "E51CB83E-8B57-436D-9599-744B0C6EB91B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Digital Alert Systems\u2019 DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application."}, {"lang": "es", "value": "El software DASDEC de Digital Alert Systems anterior a la versi\u00f3n 4.1 contiene una vulnerabilidad de cross-site scripting (XSS) que permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n a trav\u00e9s del nombre de usuario SSH, el campo de nombre de usuario de la p\u00e1gina de inicio de sesi\u00f3n o mediante el encabezado del host HTTP. El contenido inyectado se almacena en registros y se representa cuando se visualiza en la aplicaci\u00f3n web."}], "id": "CVE-2019-18265", "lastModified": "2022-12-09T00:44:47.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-11-30T23:15:09.957", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.digitalalertsystems.com/security-advisory"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}