CVE-2017-5634

Опубликовано: 09 фев. 2017

Источник: nvd

CVSS3: 6.6

CVSS2: 7.2

EPSS Низкий

Описание

The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to manipulate the print dialog.

Ссылки

http://www.securityfocus.com/bid/96230
https://bugemot.com/bug/190
Third Party Advisory
https://www.youtube.com/watch?v=2j9gP5Qu2WA
Third Party Advisory
https://www.youtube.com/watch?v=WSQW0ipnXQg
Third Party Advisory
http://www.securityfocus.com/bid/96230
https://bugemot.com/bug/190
Third Party Advisory
https://www.youtube.com/watch?v=2j9gP5Qu2WA
Third Party Advisory
https://www.youtube.com/watch?v=WSQW0ipnXQg
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:norwegian-air:norwegian_air_kiosk:-:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.0006

Низкий

6.6 Medium

CVSS3

7.2 High

CVSS2

Дефекты

CWE-668

Связанные уязвимости

GHSA-jp2p-37cw-qg8c