CVE-2014-2356

Опубликовано: 30 июл. 2014

Источник: nvd

CVSS2: 4.3

CVSS2: 5

EPSS Низкий

Описание

Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

Ссылки

https://www.cisa.gov/news-events/ics-advisories/icsa-14-189-02
http://ics-cert.us-cert.gov/advisories/ICSA-14-189-02
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:innominate:mguard_firmware:*:*:*:*:*:*:*:*

Версия до 7.5.0 (включая)

cpe:2.3:o:innominate:mguard_firmware:4.0.4:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:4.1.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:4.2.3:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:5.0.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:5.1.6:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:6.0.2:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:6.1.5:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:7.0.2:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:7.1.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:7.2.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:7.3.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:7.4.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:8.0.0:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:8.0.1:*:*:*:*:*:*:*

cpe:2.3:o:innominate:mguard_firmware:8.0.2:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01755

Низкий

4.3 Medium

CVSS2

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-p4h7-mjq9-xwq7

github

больше 3 лет назад

Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

EPSS

Процентиль: 82%

0.01755

Низкий

4.3 Medium

CVSS2

5 Medium

CVSS2

Дефекты

CWE-200