CVE-2019-11519 - OpenCVE

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Nopcommerce	Nopcommerce

Configuration 1 [-]

cpe:2.3:a:nopcommerce:nopcommerce:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/nopSolutions/nopCommerce/issues/3713	Issue Tracking Patch Third Party Advisory
https://www.nopcommerce.com/boards/t/62390/xxe-version-390.aspx	Issue Tracking Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2019-04-25T12:44:48

Updated: 2019-04-25T12:44:48

Reserved: 2019-04-25T00:00:00

Link: CVE-2019-11519

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-04-25T13:29:00.407

Modified: 2019-05-01T19:03:47.610

Link: CVE-2019-11519

JSON object: View

Redhat Information

No data.

CWE

CWE-611

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nopcommerce:nopcommerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEDDBB73-82A4-4779-8221-396DE3C11935", "versionEndIncluding": "4.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the \"Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file\" screen."}, {"lang": "es", "value": "Libraries/Nop.Services/Localization/LocalizationService.cs en nopCommerce en la versi\u00f3n 4.10, permite XEE a trav\u00e9s de la pantalla \"Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file\"."}], "id": "CVE-2019-11519", "lastModified": "2019-05-01T19:03:47.610", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-25T13:29:00.407", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/nopSolutions/nopCommerce/issues/3713"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Exploit", "Third Party Advisory"], "url": "https://www.nopcommerce.com/boards/t/62390/xxe-version-390.aspx"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}