CVE-2019-11198 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) 300583 - List Manager Dashboard module (2) 307638 - Campaign Creator module (3) 316994 - Attributes field (4) I316995 - Icon Selection module (5) 317000 - Latitude field (6) 317000 - Longitude field (7) 317017 - UploadPackage2.aspx module (8) 317072 - Context menu or (9) I317073 - Insert from Template dialog.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://dev.sitecore.net/Downloads/Sitecore20Experience20Platform/92/Sitecore20Experience20Platform209220Initial20Release/Release20Notes https://outpost24.com/blog

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1