Vulnerability Description
cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data.
CVSS Score
6.1
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jio | Jmr1140 Firmware | amtel_jmr1140_r12.07 |
| Jio | Jmr1140 | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/151654/Jiofi-4-JMR-1140-Cross-Site-ScriptinBroken LinkThird Party AdvisoryVDB Entry
- https://drive.google.com/file/d/1EhW-XfjuQfy2scjKWW_heo-7nzKWffW6/view?usp=shariExploitThird Party Advisory
- https://drive.google.com/file/d/1GlDF8RCRepNLHrgfelTMsjsYUSZvXkhw/view?usp=shariExploitThird Party Advisory
- https://jiosecuritybugs.blogspot.com/2019/02/cve-2019-7687-jiofi-4-jmr1140.htmlBroken LinkThird Party Advisory
- https://www.exploit-db.com/exploits/46363/Broken LinkThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/151654/Jiofi-4-JMR-1140-Cross-Site-ScriptinBroken LinkThird Party AdvisoryVDB Entry
- https://drive.google.com/file/d/1EhW-XfjuQfy2scjKWW_heo-7nzKWffW6/view?usp=shariExploitThird Party Advisory
- https://drive.google.com/file/d/1GlDF8RCRepNLHrgfelTMsjsYUSZvXkhw/view?usp=shariExploitThird Party Advisory
- https://jiosecuritybugs.blogspot.com/2019/02/cve-2019-7687-jiofi-4-jmr1140.htmlBroken LinkThird Party Advisory
- https://www.exploit-db.com/exploits/46363/Broken LinkThird Party AdvisoryVDB Entry
FAQ
What is CVE-2019-7687?
CVE-2019-7687 is a vulnerability with a CVSS score of 6.1 (MEDIUM). cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data.
How severe is CVE-2019-7687?
CVE-2019-7687 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-7687?
Check the references section above for vendor advisories and patch information. Affected products include: Jio Jmr1140 Firmware, Jio Jmr1140.