Vulnerability-Lookup

CVE-2013-7371 (GCVE-0-2013-7371)

Vulnerability from cvelistv5 – Published: 2019-12-11 14:04 – Updated: 2024-08-06 18:01

Summary

node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

in the Sencha Labs Connect middleware

Assigner

redhat redhat root

References

6 references

URL	Tags
https://nodesecurity.io/advisories/methodOverride…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/05/13/1	x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2…	x_refsource_MISC
https://access.redhat.com/security/cve/cve-2013-7371	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/04/21/2	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
node-connect	node-connect	Affected: < 2.8.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:01:20.475Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2013-7371"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-connect",
          "vendor": "node-connect",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "in the Sencha Labs Connect middleware",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-11T14:04:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2013-7371"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-7371",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "node-connect",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "node-connect"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "in the Sencha Labs Connect middleware"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting",
              "refsource": "MISC",
              "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2014/05/13/1",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2013-7371",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2013-7371",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2013-7371"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2014/04/21/2",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
            },
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710",
              "refsource": "MISC",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-7371",
    "datePublished": "2019-12-11T14:04:00.000Z",
    "dateReserved": "2014-04-21T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:01:20.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2013-7371",
      "date": "2026-09-24",
      "epss": "0.01435",
      "percentile": "0.71943"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sencha:connect:*:*:*:*:*:node.js:*:*",
                  "matchCriteriaId": "A9FCA2E5-A184-470E-804B-ECB041DDE67B",
                  "versionEndExcluding": "2.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
        },
        {
          "lang": "es",
          "value": "node-connects versiones anteriores a 2.8.2, presenta una vulnerabilidad de tipo cross site scripting en el middleware de Sencha Labs Connect (vulnerabilidad debido a una correcci\u00f3n incompleta para el CVE-2013-7370)"
        }
      ],
      "id": "CVE-2013-7371",
      "lastModified": "2024-11-21T02:00:51.757",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2019-12-11T15:15:13.667",
      "references": [
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Mailing List",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Broken Link",
            "Third Party Advisory"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2013-7371"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Broken Link",
            "Third Party Advisory"
          ],
          "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link",
            "Third Party Advisory"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2013-7371"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link",
            "Third Party Advisory"
          ],
          "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sencha:connect:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "A9FCA2E5-A184-470E-804B-ECB041DDE67B",
                    "versionEndExcluding": "2.8.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
          },
          {
            "lang": "es",
            "value": "node-connects versiones anteriores a 2.8.2, presenta una vulnerabilidad de tipo cross site scripting en el middleware de Sencha Labs Connect (vulnerabilidad debido a una correcci\u00f3n incompleta para el CVE-2013-7370)"
          }
        ],
        "id": "CVE-2013-7371",
        "lastModified": "2024-11-21T02:00:51.757",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2019-12-11T15:15:13.667",
        "references": [
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2013-7371"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2013-7371"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2023-02-15T05:33:15Z",
      "cve": "CVE-2013-7371",
      "id": "CVE-2013-7371",
      "initial_release_date": "2023-02-15T05:33:15Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2013-7371",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2013-7371.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2013-7371

Vulnerability from fkie_nvd - Published: 2019-12-11 15:15 - Updated: 2026-06-17 00:01

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

References

URL	Tags
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2014/04/21/2	Mailing List, Patch, Third Party Advisory
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2014/05/13/1	Mailing List, Third Party Advisory
secalert@redhat.com	https://access.redhat.com/security/cve/cve-2013-7371	Broken Link, Third Party Advisory
secalert@redhat.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/92710	Third Party Advisory, VDB Entry
secalert@redhat.com	https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting	Broken Link, Third Party Advisory
secalert@redhat.com	https://security-tracker.debian.org/tracker/CVE-2013-7371	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2014/04/21/2	Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2014/05/13/1	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/security/cve/cve-2013-7371	Broken Link, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/92710	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting	Broken Link, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security-tracker.debian.org/tracker/CVE-2013-7371	Third Party Advisory

Impacted products

Vendor	Product	Version
sencha	connect	*
debian	debian_linux	8.0
debian	debian_linux	9.0
debian	debian_linux	10.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "node-connect",
          "vendor": "node-connect",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.2"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sencha:connect:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "A9FCA2E5-A184-470E-804B-ECB041DDE67B",
              "versionEndExcluding": "2.8.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
    },
    {
      "lang": "es",
      "value": "node-connects versiones anteriores a 2.8.2, presenta una vulnerabilidad de tipo cross site scripting en el middleware de Sencha Labs Connect (vulnerabilidad debido a una correcci\u00f3n incompleta para el CVE-2013-7370)"
    }
  ],
  "id": "CVE-2013-7371",
  "lastModified": "2026-06-17T00:01:50.913",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-11T15:15:13.667",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2013-7371"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2013-7371"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6W62-83G6-RFHJ

Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2023-08-17 22:50

Summary

Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware

Details

node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

Overview

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot [method] [url]" content. The method was not properly encoded for output in the browser.

Example:

~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /

Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.

Credit:

Sergio Arcos

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "connect"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-7371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-17T22:50:28Z",
    "nvd_published_at": "2019-12-11T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)\n\n### Overview\nConnect is a stack of middleware that is executed in order in each request.\n\nThe \"methodOverride\" middleware allows the http post to override the method of the request with the value of the \"_method\" post key or with the header \"x-http-method-override\".\n\nBecause the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the \"Cannot `[method]` `[url]`\" content. The method was not properly encoded for output in the browser.\n\n\n### Example:\n```\n~ curl \"localhost:3000\" -d \"_method=\u003cscript src=http://nodesecurity.io/xss.js\u003e\u003c/script\u003e\"\nCannot \u003cSCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS\u003e\u003c/SCRIPT\u003e /\n```\n\n### Recommendation\n\nUpdate to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.\n\n### Credit:\nSergio Arcos",
  "id": "GHSA-6w62-83g6-rfhj",
  "modified": "2023-08-17T22:50:28Z",
  "published": "2022-05-05T00:29:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senchalabs/connect/issues/831"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2013-7371"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/senchalabs/connect"
    },
    {
      "type": "WEB",
      "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware"
}

GSD-2013-7371

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

Aliases

CVE-2013-7371

Aliases

CVE-2013-7371

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-7371",
    "description": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)",
    "id": "GSD-2013-7371",
    "references": [
      "https://www.suse.com/security/cve/CVE-2013-7371.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-7371"
      ],
      "details": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)",
      "id": "GSD-2013-7371",
      "modified": "2023-12-13T01:22:18.448515Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-7371",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "node-connect",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 2.8.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "node-connect"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "in the Sencha Labs Connect middleware"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting",
            "refsource": "MISC",
            "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2014/05/13/1",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
          },
          {
            "name": "https://security-tracker.debian.org/tracker/CVE-2013-7371",
            "refsource": "MISC",
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
          },
          {
            "name": "https://access.redhat.com/security/cve/cve-2013-7371",
            "refsource": "MISC",
            "url": "https://access.redhat.com/security/cve/cve-2013-7371"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2014/04/21/2",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.8.2",
          "affected_versions": "All versions before 2.8.2",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2023-08-17",
          "description": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)",
          "fixed_versions": [
            "2.8.2"
          ],
          "identifier": "CVE-2013-7371",
          "identifiers": [
            "GHSA-6w62-83g6-rfhj",
            "CVE-2013-7371"
          ],
          "not_impacted": "All versions starting from 2.8.2",
          "package_slug": "npm/connect",
          "pubdate": "2022-05-05",
          "solution": "Upgrade to version 2.8.2 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2013-7371",
            "https://access.redhat.com/security/cve/cve-2013-7371",
            "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710",
            "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting",
            "https://security-tracker.debian.org/tracker/CVE-2013-7371",
            "http://www.openwall.com/lists/oss-security/2014/04/21/2",
            "http://www.openwall.com/lists/oss-security/2014/05/13/1",
            "https://github.com/senchalabs/connect/issues/831",
            "https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a",
            "https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135",
            "https://github.com/advisories/GHSA-6w62-83g6-rfhj"
          ],
          "uuid": "cb6ca494-4dc8-4448-8301-b3cf30c14656"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sencha:connect:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.8.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-7371"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92710"
            },
            {
              "name": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting",
              "refsource": "MISC",
              "tags": [
                "Broken Link",
                "Third Party Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2013-7371",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security-tracker.debian.org/tracker/CVE-2013-7371"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2013-7371",
              "refsource": "MISC",
              "tags": [
                "Broken Link",
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/security/cve/cve-2013-7371"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2014/05/13/1",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2014/04/21/2",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2014/04/21/2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2019-12-16T19:57Z",
      "publishedDate": "2019-12-11T15:15Z"
    }
  }
}

UBUNTU-CVE-2013-7371 (CVE-2013-7371)

Vulnerability from osv_ubuntu – Published: 2019-12-11 15:15 – Updated: 2025-07-16 04:50 – Source website

Withdrawn 2025-07-18

Details

node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2013-7371	REPORT
	https://www.cve.org/CVERecord?id=CVE-2013-7371	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "node-connect",
            "binary_version": "3.3.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "node-connect",
        "purl": "pkg:deb/ubuntu/node-connect@3.3.0-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.0-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "details": "node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)",
  "id": "UBUNTU-CVE-2013-7371",
  "modified": "2025-07-16T04:50:24Z",
  "published": "2019-12-11T15:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-7371"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-7371"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2013-7371"
  ],
  "withdrawn": "2025-07-18T16:42:57Z"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2013-7371 (GCVE-0-2013-7371)

FKIE_CVE-2013-7371

GHSA-6W62-83G6-RFHJ

Overview

Example:

Recommendation

Credit:

GSD-2013-7371

UBUNTU-CVE-2013-7371 (CVE-2013-7371)

Tags

Sightings

Nomenclature

Related by attack behaviour