CVE-2019-19327

Published: Nov 27, 2019 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2019-8948 Aliases: GSD-2019-19327

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 6,1

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: changed

Confidentiality: low

Integrity: low

Availability: none

MEDIUM 4,3

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: none

Integrity: partial

Availability: none

Description

AI Translation Available

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,0063

Percentile

0,7th

Updated

EPSS Score Trend (Last 90 Days)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Access Control Confidentiality Integrity Availability

Potential Impacts:

Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands

Applicable Platforms

Technologies: AI/ML, Web Based, Web Server

Likelihood of Exploit: High

View CWE Details

Application

Wikidata Query Gui by Wikimedia

Product Information

Vendor Wikimedia

Product Wikidata Query Gui

Version 0.3.6

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:wikimedia:wikidata_query_gui:0.3.6:2019-11-07:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Application

Wikidata Query Gui by Wikimedia

Product Information

Vendor Wikimedia

Product Wikidata Query Gui

Version 0.3.6

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:wikimedia:wikidata_query_gui:0.3.6:-:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Application

Wikidata Query Gui by Wikimedia

Product Information

Vendor Wikimedia

Product Wikidata Query Gui

Version Range Affected

To 0.3.5 (inclusive)

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:wikimedia:wikidata_query_gui:*:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833…