{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-05-14T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "53559", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/53559"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"}, {"name": "jce-joomla-index-xss(75670)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"}, {"name": "49206", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/49206"}, {"tags": ["x_refsource_MISC"], "url": "http://secunia.com/secunia_research/2012-14/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-2901", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "53559", "refsource": "BID", "url": "http://www.securityfocus.com/bid/53559"}, {"name": "http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32", "refsource": "CONFIRM", "url": "http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"}, {"name": "jce-joomla-index-xss(75670)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"}, {"name": "49206", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/49206"}, {"name": "http://secunia.com/secunia_research/2012-14/", "refsource": "MISC", "url": "http://secunia.com/secunia_research/2012-14/"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-2901", "datePublished": "2012-05-21T18:00:00", "dateReserved": "2012-05-21T00:00:00", "dateUpdated": "2017-08-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ryan_demmer:joomla_content_editor:*:*:*:*:*:*:*:*", "matchCriteriaId": "92C9BDA4-CE80-4A40-9E91-5AC89F610390", "versionEndIncluding": "2.0.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:ryan_demmer:joomla_content_editor:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "B8F60EF7-C422-40FF-8A70-1F5DCB096BF5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*", "matchCriteriaId": "2AC7400C-F6AF-4B5E-A34B-0222F94DCC46", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la lista de perfiles (\"Profile List\") del componente Joomla Content Editor (JCE) en versiones anteriores a la 2.1 de Joomla!. Permite a atacantes remotos inyectar codigo de script web o c\u00f3digo HTML de su elecci\u00f3n a trav\u00e9s del parametro search de administrator/index.php."}], "id": "CVE-2012-2901", "lastModified": "2017-08-29T01:31:44.523", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2012-05-21T18:55:02.413", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/49206"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/secunia_research/2012-14/"}, {"source": "cve@mitre.org", "url": "http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/53559"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75670"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}