Details of VAR-201909-0613

ID

VAR-201909-0613

CVE

CVE-2019-16104

TITLE

Silver Peak EdgeConnect SD-WAN Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-009035

DESCRIPTION

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH_INFO. Silver Peak EdgeConnect SD-WAN Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The platform mainly provides functions such as path conditioning, application classification, routing and virtual WAN overlay. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.71

sources: NVD: CVE-2019-16104 // JVNDB: JVNDB-2019-009035 // VULHUB: VHN-148217

AFFECTED PRODUCTS

vendor:	silver peak	model:	unity edgeconnect sd-wan	scope:	eq	version:	8.1.4.9_65644	Trust: 1.0
vendor:	silver peak	model:	unity edgeconnect sd-wan	scope:	lt	version:	8.1.7.x	Trust: 0.8

sources: JVNDB: JVNDB-2019-009035 // NVD: CVE-2019-16104

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-16104
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-16104
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201909-286
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-148217
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-16104
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-148217
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-16104
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.1
Trust: 1.0
NVD:	CVE-2019-16104
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-148217 // JVNDB: JVNDB-2019-009035 // CNNVD: CNNVD-201909-286 // NVD: CVE-2019-16104

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-148217 // JVNDB: JVNDB-2019-009035 // NVD: CVE-2019-16104

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201909-286

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-009035

PATCH

title:

Unity EdgeConnect

url:

https://www.silver-peak.com/products/unity-edge-connect

Trust: 0.8

sources: JVNDB: JVNDB-2019-009035

EXTERNAL IDS

db:	NVD	id:	CVE-2019-16104	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-009035	Trust: 0.8
db:	CNNVD	id:	CNNVD-201909-286	Trust: 0.7
db:	VULHUB	id:	VHN-148217	Trust: 0.1

sources: VULHUB: VHN-148217 // JVNDB: JVNDB-2019-009035 // CNNVD: CNNVD-201909-286 // NVD: CVE-2019-16104

REFERENCES

url:	https://github.com/sdnewhop/sdwannewhope/blob/master/reports/silverpeak%20edgeconnect%20multiple%20vulnerabilities%20-%20032018.pdf	Trust: 2.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-16104	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-16104	Trust: 0.8

sources: VULHUB: VHN-148217 // JVNDB: JVNDB-2019-009035 // CNNVD: CNNVD-201909-286 // NVD: CVE-2019-16104

SOURCES

db:	VULHUB	id:	VHN-148217
db:	JVNDB	id:	JVNDB-2019-009035
db:	CNNVD	id:	CNNVD-201909-286
db:	NVD	id:	CVE-2019-16104

LAST UPDATE DATE

2024-11-23T22:44:53.834000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-148217	date:	2019-09-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-009035	date:	2019-09-11T00:00:00
db:	CNNVD	id:	CNNVD-201909-286	date:	2019-09-12T00:00:00
db:	NVD	id:	CVE-2019-16104	date:	2024-11-21T04:30:03.043

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-148217	date:	2019-09-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-009035	date:	2019-09-11T00:00:00
db:	CNNVD	id:	CNNVD-201909-286	date:	2019-09-08T00:00:00
db:	NVD	id:	CVE-2019-16104	date:	2019-09-08T17:15:11.127