CVEvulnerability
CVE-2019-7551
9.0 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-04-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-79
Description
Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users, including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app.
Affected configurations
• cantemo portal (< 3.2.13)
• cantemo portal (>= 3.3.0 < 3.3.8)
• cantemo portal (>= 3.4.0 < 3.4.9)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://blog-posts--cantemo.netlify.com/news/2019/03/cantemo-portal-xss-vulnerabilities/ Release Notes, Vendor Advisory
- https://doc.cantemo.com/latest/ReleaseNotes/intro.html#version-3-4-9 Release Notes, Vendor Advisory
- https://www.bishopfox.com/blog/news-category/advisories/ Third Party Advisory
- https://www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/ Exploit, Third Party Advisory
- https://blog-posts--cantemo.netlify.com/news/2019/03/cantemo-portal-xss-vulnerabilities/ Release Notes, Vendor Advisory
- https://doc.cantemo.com/latest/ReleaseNotes/intro.html#version-3-4-9 Release Notes, Vendor Advisory
- https://www.bishopfox.com/blog/news-category/advisories/ Third Party Advisory
- https://www.bishopfox.com/news/2019/03/cantemo-portal-version-3-8-4-cross-site-scripting/ Exploit, Third Party Advisory