Details of VAR-202004-0758

ID

VAR-202004-0758

CVE

CVE-2019-20738

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-015455

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.58, D7800 before 1.0.1.34, JNR1010v2 before 1.1.0.50, JWNR2010v5 before 1.1.0.50, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, R6020 before 1.0.0.30, R6080 before 1.0.0.30, R6100 before 1.0.1.16, R6120 before 1.0.0.40, R6700v2 before 1.2.0.14, R6800 before 1.2.0.14, R6900v2 before 1.2.0.14, R7500v2 before 1.0.3.26, R7800 before 1.0.2.46, R9000 before 1.0.4.2, WN3000RPv2 before 1.0.0.52, WN3000RPv3 before 1.0.2.78, WNDR3700v4 before 1.0.2.102, WNDR3700v5 before 1.1.0.54, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.50, WNR2000v5 before 1.0.0.64, WNR2020 before 1.1.0.50, and WNR2050 before 1.1.0.50. NOTE: this may be a result of an incomplete fix for CVE-2017-18866. plural NETGEAR A cross-site scripting vulnerability exists in the device. This vulnerability is CVE-2017-18866 This is a vulnerability caused by an incomplete fix for.Information may be obtained and tampered with

Trust: 1.62

sources: NVD: CVE-2019-20738 // JVNDB: JVNDB-2019-015455

AFFECTED PRODUCTS

vendor:	netgear	model:	wnr2020	scope:	lt	version:	1.1.0.50	Trust: 1.0
vendor:	netgear	model:	wndr4300	scope:	lt	version:	1.0.2.104	Trust: 1.0
vendor:	netgear	model:	r6100	scope:	lt	version:	1.0.1.16	Trust: 1.0
vendor:	netgear	model:	r6120	scope:	lt	version:	1.0.0.40	Trust: 1.0
vendor:	netgear	model:	wndr3700	scope:	lt	version:	1.1.0.54	Trust: 1.0
vendor:	netgear	model:	rbs50	scope:	lt	version:	2.3.5.30	Trust: 1.0
vendor:	netgear	model:	wndr4300	scope:	lt	version:	1.0.0.48	Trust: 1.0
vendor:	netgear	model:	rbr50	scope:	lt	version:	2.3.5.30	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.34	Trust: 1.0
vendor:	netgear	model:	d6100	scope:	lt	version:	1.0.0.58	Trust: 1.0
vendor:	netgear	model:	wnr1000	scope:	lt	version:	1.1.0.50	Trust: 1.0
vendor:	netgear	model:	r6080	scope:	lt	version:	1.0.0.30	Trust: 1.0
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.2.78	Trust: 1.0
vendor:	netgear	model:	r7500	scope:	lt	version:	1.0.3.26	Trust: 1.0
vendor:	netgear	model:	wndr3700	scope:	lt	version:	1.0.2.102	Trust: 1.0
vendor:	netgear	model:	jnr1010	scope:	lt	version:	1.1.0.50	Trust: 1.0
vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.46	Trust: 1.0
vendor:	netgear	model:	r6020	scope:	lt	version:	1.0.0.30	Trust: 1.0
vendor:	netgear	model:	rbk50	scope:	lt	version:	2.3.5.30	Trust: 1.0
vendor:	netgear	model:	r6700	scope:	lt	version:	1.2.0.14	Trust: 1.0
vendor:	netgear	model:	r6900	scope:	lt	version:	1.2.0.14	Trust: 1.0
vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.4.2	Trust: 1.0
vendor:	netgear	model:	wndr4500	scope:	lt	version:	1.0.0.48	Trust: 1.0
vendor:	netgear	model:	r6800	scope:	lt	version:	1.2.0.14	Trust: 1.0
vendor:	netgear	model:	wnr2000	scope:	lt	version:	1.0.0.64	Trust: 1.0
vendor:	netgear	model:	wnr2050	scope:	lt	version:	1.1.0.50	Trust: 1.0
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.0.52	Trust: 1.0
vendor:	netgear	model:	jwnr2010	scope:	lt	version:	1.1.0.50	Trust: 1.0
vendor:	netgear	model:	d6100	scope:	eq	version:	1.0.0.58	Trust: 0.8
vendor:	netgear	model:	d7800	scope:	eq	version:	1.0.1.34	Trust: 0.8
vendor:	netgear	model:	jnr1010	scope:	eq	version:	1.1.0.50	Trust: 0.8
vendor:	netgear	model:	jwnr2010	scope:	eq	version:	1.1.0.50	Trust: 0.8
vendor:	netgear	model:	r6020	scope:	eq	version:	1.0.0.30	Trust: 0.8
vendor:	netgear	model:	r6080	scope:	eq	version:	1.0.0.30	Trust: 0.8
vendor:	netgear	model:	r6100	scope:	eq	version:	1.0.1.16	Trust: 0.8
vendor:	netgear	model:	rbk50	scope:	eq	version:	2.3.5.30	Trust: 0.8
vendor:	netgear	model:	rbr50	scope:	eq	version:	2.3.5.30	Trust: 0.8
vendor:	netgear	model:	rbs50	scope:	eq	version:	2.3.5.30	Trust: 0.8

sources: JVNDB: JVNDB-2019-015455 // NVD: CVE-2019-20738

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20738
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2019-20738
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015455
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202004-1349
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-20738
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-015455
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2019-20738
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20738
baseSeverity:	MEDIUM
baseScore:	5.2
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.1
impactScore:	2.7
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015455
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-015455 // CNNVD: CNNVD-202004-1349 // NVD: CVE-2019-20738 // NVD: CVE-2019-20738

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-015455 // NVD: CVE-2019-20738

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1349

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1349

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015455

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some Routers, Gateways, and WiFi System, PSV-2016-0100	url:	https://kb.netgear.com/000061187/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-WiFi-System-PSV-2016-0100	Trust: 0.8
title:	Multiple NETGEAR Fixes for product cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=114908	Trust: 0.6

sources: JVNDB: JVNDB-2019-015455 // CNNVD: CNNVD-202004-1349

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20738	Trust: 2.4
db:	JVNDB	id:	JVNDB-2019-015455	Trust: 0.8
db:	CNNVD	id:	CNNVD-202004-1349	Trust: 0.6

sources: JVNDB: JVNDB-2019-015455 // CNNVD: CNNVD-202004-1349 // NVD: CVE-2019-20738

REFERENCES

url:	https://kb.netgear.com/000061187/security-advisory-for-stored-cross-site-scripting-on-some-routers-gateways-and-wifi-system-psv-2016-0100	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20738	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20738	Trust: 0.8

sources: JVNDB: JVNDB-2019-015455 // CNNVD: CNNVD-202004-1349 // NVD: CVE-2019-20738

SOURCES

db:	JVNDB	id:	JVNDB-2019-015455
db:	CNNVD	id:	CNNVD-202004-1349
db:	NVD	id:	CVE-2019-20738

LAST UPDATE DATE

2024-11-23T22:51:27.268000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-015455	date:	2020-05-20T00:00:00
db:	CNNVD	id:	CNNVD-202004-1349	date:	2020-05-06T00:00:00
db:	NVD	id:	CVE-2019-20738	date:	2024-11-21T04:39:13.863

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-015455	date:	2020-05-20T00:00:00
db:	CNNVD	id:	CNNVD-202004-1349	date:	2020-04-16T00:00:00
db:	NVD	id:	CVE-2019-20738	date:	2020-04-16T20:15:13.820