Details of VAR-201912-0711

ID

VAR-201912-0711

CVE

CVE-2019-20072

TITLE

Netis DL4323 Device cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013475

DESCRIPTION

On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration). Netis DL4323 The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. NETCORE Netis DL4323 is a multifunctional modem from China Netcore Corporation. A cross-site scripting vulnerability exists in NETCORE Netis DL4323. The vulnerability stems from the lack of proper verification of client data by web applications. Attackers can use this vulnerability to execute client code

Trust: 2.25

sources: NVD: CVE-2019-20072 // JVNDB: JVNDB-2019-013475 // CNVD: CNVD-2020-01649 // VULMON: CVE-2019-20072

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-01649

AFFECTED PRODUCTS

vendor:	netis	model:	dl4343	scope:	eq	version:	-	Trust: 2.2
vendor:	netis	model:	dl4323	scope:	-	version:	-	Trust: 0.8
vendor:	netcore	model:	netis dl4323	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-01649 // JVNDB: JVNDB-2019-013475 // CNNVD: CNNVD-201912-1200 // NVD: CVE-2019-20072

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20072
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-20072
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-01649
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201912-1200
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2019-20072
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-20072
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-01649
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20072
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.1
Trust: 1.0
NVD:	CVE-2019-20072
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-01649 // VULMON: CVE-2019-20072 // JVNDB: JVNDB-2019-013475 // CNNVD: CNNVD-201912-1200 // NVD: CVE-2019-20072

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-013475 // NVD: CVE-2019-20072

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201912-1200

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201912-1200

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013475

PATCH

title:

DL4323

url:

http://www.netis-systems.com/Home/detail/id/75.html

Trust: 0.8

sources: JVNDB: JVNDB-2019-013475

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20072	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-013475	Trust: 0.8
db:	CNVD	id:	CNVD-2020-01649	Trust: 0.6
db:	CNNVD	id:	CNNVD-201912-1200	Trust: 0.6
db:	VULMON	id:	CVE-2019-20072	Trust: 0.1

sources: CNVD: CNVD-2020-01649 // VULMON: CVE-2019-20072 // JVNDB: JVNDB-2019-013475 // CNNVD: CNNVD-201912-1200 // NVD: CVE-2019-20072

REFERENCES

url:	https://fatihhcelik.blogspot.com/2019/12/xss-vulnerability-on-hostname-input.html	Trust: 3.1
url:	https://drive.google.com/open?id=1igryvci8fxic0jjjb-pafak1kj4v2ygm	Trust: 2.3
url:	https://drive.google.com/open?id=1vpex136-javdey0jgqtqrndmtpohfen7	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20072	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20072	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-01649 // VULMON: CVE-2019-20072 // JVNDB: JVNDB-2019-013475 // CNNVD: CNNVD-201912-1200 // NVD: CVE-2019-20072

SOURCES

db:	CNVD	id:	CNVD-2020-01649
db:	VULMON	id:	CVE-2019-20072
db:	JVNDB	id:	JVNDB-2019-013475
db:	CNNVD	id:	CNNVD-201912-1200
db:	NVD	id:	CVE-2019-20072

LAST UPDATE DATE

2024-11-23T21:51:49.729000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-01649	date:	2020-01-13T00:00:00
db:	VULMON	id:	CVE-2019-20072	date:	2020-01-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-013475	date:	2020-01-07T00:00:00
db:	CNNVD	id:	CNNVD-201912-1200	date:	2019-12-31T00:00:00
db:	NVD	id:	CVE-2019-20072	date:	2024-11-21T04:38:00.320

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-01649	date:	2020-01-09T00:00:00
db:	VULMON	id:	CVE-2019-20072	date:	2019-12-30T00:00:00
db:	JVNDB	id:	JVNDB-2019-013475	date:	2020-01-07T00:00:00
db:	CNNVD	id:	CNNVD-201912-1200	date:	2019-12-29T00:00:00
db:	NVD	id:	CVE-2019-20072	date:	2019-12-30T00:15:11.270