CVE-2017-11130

Опубликовано: 01 авг. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.

Ссылки

http://seclists.org/fulldisclosure/2017/Jul/90
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jul/90
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:stashcat:heinekingmedia:*:*:*:*:*:android:*:*

Версия до 1.7.5 (включая)

Конфигурация 2

cpe:2.3:a:stashcat:heinekingmedia:*:*:*:*:web:*:*:*

Версия до 0.0.80w (включая)

Конфигурация 3

cpe:2.3:a:stashcat:heinekingmedia:*:*:*:*:desktop:*:*:*

Версия до 0.0.86w (включая)

EPSS

Процентиль: 37%

0.00156

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-p2wm-hvrr-c5c3