{"containers": {"cna": {"affected": [{"product": "BlackBerry UEM", "vendor": "BlackBerry", "versions": [{"status": "affected", "version": "12.9.0 and earlier"}]}], "datePublic": "2018-12-20T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator."}], "problemTypes": [{"descriptions": [{"description": "Stored Cross-Site Scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-20T19:57:01", "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@blackberry.com", "ID": "CVE-2018-8891", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "BlackBerry UEM", "version": {"version_data": [{"version_value": "12.9.0 and earlier"}]}}]}, "vendor_name": "BlackBerry"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Stored Cross-Site Scripting"}]}]}, "references": {"reference_data": [{"name": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162", "refsource": "CONFIRM", "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162"}]}}}}, "cveMetadata": {"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "assignerShortName": "blackberry", "cveId": "CVE-2018-8891", "datePublished": "2018-12-20T20:00:00", "dateReserved": "2018-03-21T00:00:00", "dateUpdated": "2018-12-20T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0AFB64F-41FB-4D16-98BA-40F5F7B95C5E", "versionEndExcluding": "12.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades Cross-Site Scripting (XSS) persistente en la consola de gesti\u00f3n de BlackBerry UEM, en versiones anteriores a la 12.9.1, podr\u00edan permitir que un atacante almacene comandos script que podr\u00edan ejecutarse posteriormente en el contexto de otro administrador de la consola."}], "id": "CVE-2018-8891", "lastModified": "2019-01-03T18:25:12.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-20T20:29:00.433", "references": [{"source": "secure@blackberry.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000054162"}], "sourceIdentifier": "secure@blackberry.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}