vulnwire
4.3med

CVE-2017-20044

Navetti PricePoint Reflected cross site scriting

Published 4 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction (EPSS)

0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • Navetti PricePoint

Classification

Weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • seclists.org /fulldisclosure/2017/Mar/24 · x_refsource_MISC, x_transferred
  • vuldb.com /?id.97863 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.