Details of VAR-202004-0935

ID

VAR-202004-0935

CVE

CVE-2019-20670

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-015338

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30. NETGEAR RBR50 , RBS50 , RBK50 A cross-site scripting vulnerability exists in the device.Information may be obtained and tampered with. NETGEAR RBK50 is a wireless router of NETGEAR. This vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute Client code. This affects RBR50 prior to 2.3.5.30, RBS50 prior to 2.3.5.30, and RBK50 prior to 2.3.5.30

Trust: 2.25

sources: NVD: CVE-2019-20670 // JVNDB: JVNDB-2019-015338 // CNVD: CNVD-2020-24412 // VULMON: CVE-2019-20670

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-24412

AFFECTED PRODUCTS

vendor:	netgear	model:	rbr50	scope:	lt	version:	2.3.5.30	Trust: 1.6
vendor:	netgear	model:	rbs50	scope:	lt	version:	2.3.5.30	Trust: 1.6
vendor:	netgear	model:	rbk50	scope:	lt	version:	2.3.5.30	Trust: 1.6
vendor:	netgear	model:	rbk50	scope:	eq	version:	2.3.5.30	Trust: 0.8
vendor:	netgear	model:	rbr50	scope:	eq	version:	2.3.5.30	Trust: 0.8
vendor:	netgear	model:	rbs50	scope:	eq	version:	2.3.5.30	Trust: 0.8

sources: CNVD: CNVD-2020-24412 // JVNDB: JVNDB-2019-015338 // NVD: CVE-2019-20670

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20670
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2019-20670
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015338
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-24412
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202004-1216
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2019-20670
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-20670
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2019-015338
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-24412
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20670
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20670
baseSeverity:	MEDIUM
baseScore:	6.0
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.8
impactScore:	5.2
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015338
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-24412 // VULMON: CVE-2019-20670 // JVNDB: JVNDB-2019-015338 // CNNVD: CNNVD-202004-1216 // NVD: CVE-2019-20670 // NVD: CVE-2019-20670

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-015338 // NVD: CVE-2019-20670

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1216

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1216

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015338

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some WiFi Systems, PSV-2018-0549	url:	https://kb.netgear.com/000061469/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-WiFi-Systems-PSV-2018-0549	Trust: 0.8
title:	Patch for Multiple NETGEAR product cross-site scripting vulnerabilities (CNVD-2020-24412)	url:	https://www.cnvd.org.cn/patchInfo/show/215201	Trust: 0.6
title:	Multiple NETGEAR Fixes for product cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116515	Trust: 0.6

sources: CNVD: CNVD-2020-24412 // JVNDB: JVNDB-2019-015338 // CNNVD: CNNVD-202004-1216

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20670	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-015338	Trust: 0.8
db:	CNVD	id:	CNVD-2020-24412	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1216	Trust: 0.6
db:	VULMON	id:	CVE-2019-20670	Trust: 0.1

sources: CNVD: CNVD-2020-24412 // VULMON: CVE-2019-20670 // JVNDB: JVNDB-2019-015338 // CNNVD: CNNVD-202004-1216 // NVD: CVE-2019-20670

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2019-20670	Trust: 2.0
url:	https://kb.netgear.com/000061469/security-advisory-for-stored-cross-site-scripting-on-some-wifi-systems-psv-2018-0549	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20670	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-24412 // VULMON: CVE-2019-20670 // JVNDB: JVNDB-2019-015338 // CNNVD: CNNVD-202004-1216 // NVD: CVE-2019-20670

SOURCES

db:	CNVD	id:	CNVD-2020-24412
db:	VULMON	id:	CVE-2019-20670
db:	JVNDB	id:	JVNDB-2019-015338
db:	CNNVD	id:	CNNVD-202004-1216
db:	NVD	id:	CVE-2019-20670

LAST UPDATE DATE

2024-11-23T22:11:31.013000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-24412	date:	2020-04-24T00:00:00
db:	VULMON	id:	CVE-2019-20670	date:	2020-04-20T00:00:00
db:	JVNDB	id:	JVNDB-2019-015338	date:	2020-05-13T00:00:00
db:	CNNVD	id:	CNNVD-202004-1216	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2019-20670	date:	2024-11-21T04:39:01.253

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-24412	date:	2020-04-24T00:00:00
db:	VULMON	id:	CVE-2019-20670	date:	2020-04-15T00:00:00
db:	JVNDB	id:	JVNDB-2019-015338	date:	2020-05-13T00:00:00
db:	CNNVD	id:	CNNVD-202004-1216	date:	2020-04-15T00:00:00
db:	NVD	id:	CVE-2019-20670	date:	2020-04-15T20:15:13.957