Details of VAR-201912-0714

ID

VAR-201912-0714

CVE

CVE-2019-20075

TITLE

Netis DL4323 Device cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013472

DESCRIPTION

On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic). Netis DL4323 The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. NETCORE Netis DL4323 is a multifunctional modem of China Netcore Corporation. A cross-site scripting vulnerability exists in the pingrtt_v6.html page in NETCORE Netis DL4323. The vulnerability stems from the lack of proper validation of client data by web applications. An attacker could use this vulnerability to execute client code

Trust: 2.16

sources: NVD: CVE-2019-20075 // JVNDB: JVNDB-2019-013472 // CNVD: CNVD-2020-02549

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-02549

AFFECTED PRODUCTS

vendor:	netis	model:	dl4343	scope:	eq	version:	-	Trust: 2.2
vendor:	netis	model:	dl4323	scope:	-	version:	-	Trust: 0.8
vendor:	netcore	model:	netis dl4323	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-02549 // JVNDB: JVNDB-2019-013472 // CNNVD: CNNVD-201912-1203 // NVD: CVE-2019-20075

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20075
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-20075
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-02549
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201912-1203
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-20075
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-02549
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20075
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.1
Trust: 1.0
NVD:	CVE-2019-20075
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-02549 // JVNDB: JVNDB-2019-013472 // CNNVD: CNNVD-201912-1203 // NVD: CVE-2019-20075

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-013472 // NVD: CVE-2019-20075

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201912-1203

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201912-1203

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013472

PATCH

title:

DL4323

url:

http://www.netis-systems.com/Home/detail/id/75.html

Trust: 0.8

sources: JVNDB: JVNDB-2019-013472

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20075	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-013472	Trust: 0.8
db:	CNVD	id:	CNVD-2020-02549	Trust: 0.6
db:	CNNVD	id:	CNNVD-201912-1203	Trust: 0.6

sources: CNVD: CNVD-2020-02549 // JVNDB: JVNDB-2019-013472 // CNNVD: CNNVD-201912-1203 // NVD: CVE-2019-20075

REFERENCES

url:	https://fatihhcelik.blogspot.com/2019/12/xss-vulnerability-on-ping6.html	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20075	Trust: 2.0
url:	https://drive.google.com/open?id=1squhatn_dvsgv-ytvaqpoxg1z9apk0ei	Trust: 1.6
url:	https://drive.google.com/open?id=1795_jogal3qxmfejojpingb_d913xepx	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20075	Trust: 0.8

sources: CNVD: CNVD-2020-02549 // JVNDB: JVNDB-2019-013472 // CNNVD: CNNVD-201912-1203 // NVD: CVE-2019-20075

SOURCES

db:	CNVD	id:	CNVD-2020-02549
db:	JVNDB	id:	JVNDB-2019-013472
db:	CNNVD	id:	CNNVD-201912-1203
db:	NVD	id:	CVE-2019-20075

LAST UPDATE DATE

2024-11-23T22:33:38.549000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-02549	date:	2020-01-17T00:00:00
db:	JVNDB	id:	JVNDB-2019-013472	date:	2020-01-07T00:00:00
db:	CNNVD	id:	CNNVD-201912-1203	date:	2019-12-31T00:00:00
db:	NVD	id:	CVE-2019-20075	date:	2024-11-21T04:38:00.753

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-02549	date:	2020-01-17T00:00:00
db:	JVNDB	id:	JVNDB-2019-013472	date:	2020-01-07T00:00:00
db:	CNNVD	id:	CNNVD-201912-1203	date:	2019-12-29T00:00:00
db:	NVD	id:	CVE-2019-20075	date:	2019-12-30T00:15:11.660