Details of VAR-202004-0783

ID

VAR-202004-0783

CVE

CVE-2019-20721

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-015408

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.47, EX2700 before 1.0.1.48, EX6100v2 before 1.0.1.76, EX6150v2 before 1.0.1.76, EX6200v2 before 1.0.1.72, EX6400 before 1.0.2.136, EX7300 before 1.0.2.136, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv2 before 1.0.0.68, WN3000RPv3 before 1.0.2.70, WN3100RPv2 before 1.0.0.66, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.66, XR450 before 2.3.2.32, and XR500 before 2.3.2.32. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and tampered with

Trust: 1.62

sources: NVD: CVE-2019-20721 // JVNDB: JVNDB-2019-015408

AFFECTED PRODUCTS

vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.4.12	Trust: 1.0
vendor:	netgear	model:	ex6150	scope:	lt	version:	1.0.1.76	Trust: 1.0
vendor:	netgear	model:	ex6200	scope:	lt	version:	1.0.1.72	Trust: 1.0
vendor:	netgear	model:	xr450	scope:	lt	version:	2.3.2.32	Trust: 1.0
vendor:	netgear	model:	r7500	scope:	lt	version:	1.0.3.38	Trust: 1.0
vendor:	netgear	model:	wndr4500	scope:	lt	version:	1.0.0.58	Trust: 1.0
vendor:	netgear	model:	wn2000rpt	scope:	lt	version:	1.0.1.32	Trust: 1.0
vendor:	netgear	model:	wnr2000	scope:	lt	version:	1.0.0.66	Trust: 1.0
vendor:	netgear	model:	ex6400	scope:	lt	version:	1.0.2.136	Trust: 1.0
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.2.70	Trust: 1.0
vendor:	netgear	model:	ex7300	scope:	lt	version:	1.0.2.136	Trust: 1.0
vendor:	netgear	model:	r8900	scope:	lt	version:	1.0.4.12	Trust: 1.0
vendor:	netgear	model:	ex6100	scope:	lt	version:	1.0.1.76	Trust: 1.0
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.0.68	Trust: 1.0
vendor:	netgear	model:	ex2700	scope:	lt	version:	1.0.1.48	Trust: 1.0
vendor:	netgear	model:	xr500	scope:	lt	version:	2.3.2.32	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.47	Trust: 1.0
vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.52	Trust: 1.0
vendor:	netgear	model:	wn3100rp	scope:	lt	version:	1.0.0.66	Trust: 1.0
vendor:	netgear	model:	wndr4300	scope:	lt	version:	1.0.0.58	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	eq	version:	1.0.1.47	Trust: 0.8
vendor:	netgear	model:	ex2700	scope:	eq	version:	1.0.1.48	Trust: 0.8
vendor:	netgear	model:	ex6100	scope:	eq	version:	1.0.1.76	Trust: 0.8
vendor:	netgear	model:	ex6150	scope:	eq	version:	1.0.1.76	Trust: 0.8
vendor:	netgear	model:	ex6200	scope:	eq	version:	1.0.1.72	Trust: 0.8
vendor:	netgear	model:	ex6400	scope:	eq	version:	1.0.2.136	Trust: 0.8
vendor:	netgear	model:	ex7300	scope:	eq	version:	1.0.2.136	Trust: 0.8
vendor:	netgear	model:	r7500	scope:	eq	version:	1.0.3.38	Trust: 0.8
vendor:	netgear	model:	r7800	scope:	eq	version:	1.0.2.52	Trust: 0.8
vendor:	netgear	model:	r8900	scope:	eq	version:	1.0.4.12	Trust: 0.8

sources: JVNDB: JVNDB-2019-015408 // NVD: CVE-2019-20721

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20721
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2019-20721
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015408
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202004-1305
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-20721
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-015408
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2019-20721
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20721
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015408
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-015408 // CNNVD: CNNVD-202004-1305 // NVD: CVE-2019-20721 // NVD: CVE-2019-20721

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-015408 // NVD: CVE-2019-20721

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1305

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1305

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015408

PATCH

title:

Security Advisory for Stored Cross Site Scripting on Some Routers, Gateways, and Extenders, PSV-2018-0159

url:

https://kb.netgear.com/000061207/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0159

Trust: 0.8

sources: JVNDB: JVNDB-2019-015408

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20721	Trust: 2.4
db:	JVNDB	id:	JVNDB-2019-015408	Trust: 0.8
db:	CNNVD	id:	CNNVD-202004-1305	Trust: 0.6

sources: JVNDB: JVNDB-2019-015408 // CNNVD: CNNVD-202004-1305 // NVD: CVE-2019-20721

REFERENCES

url:	https://kb.netgear.com/000061207/security-advisory-for-stored-cross-site-scripting-on-some-routers-gateways-and-extenders-psv-2018-0159	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20721	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20721	Trust: 0.8

sources: JVNDB: JVNDB-2019-015408 // CNNVD: CNNVD-202004-1305 // NVD: CVE-2019-20721

CREDITS

aircut

Trust: 0.6

sources: CNNVD: CNNVD-202004-1305

SOURCES

db:	JVNDB	id:	JVNDB-2019-015408
db:	CNNVD	id:	CNNVD-202004-1305
db:	NVD	id:	CVE-2019-20721

LAST UPDATE DATE

2024-11-23T22:48:02.128000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-015408	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1305	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2019-20721	date:	2024-11-21T04:39:10.943

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-015408	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1305	date:	2020-04-16T00:00:00
db:	NVD	id:	CVE-2019-20721	date:	2020-04-16T19:15:25.227