CVE-2016-2296

Опубликовано: 14 мая 2016

Источник: nvd

CVSS3: 9.4

CVSS2: 7.5

EPSS Высокий

Описание

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.

Ссылки

http://seclists.org/fulldisclosure/2016/May/52
https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/39822/
http://seclists.org/fulldisclosure/2016/May/52
https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/39822/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:meteocontrol:web\'log_basic_100:-:*:*:*:*:*:*:*

cpe:2.3:a:meteocontrol:web\'log_light:-:*:*:*:*:*:*:*

cpe:2.3:a:meteocontrol:web\'log_pro:-:*:*:*:*:*:*:*

cpe:2.3:a:meteocontrol:web\'log_pro_unlimited:-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.75312

Высокий

9.4 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-254

Связанные уязвимости

GHSA-g7wf-vfjj-8q52