CVE-2019-13030

Опубликовано: 14 авг. 2019

Источник: nvd

CVSS3: 8.2

CVSS2: 6.4

EPSS Низкий

Описание

eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.

Ссылки

https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md
Exploit
Third Party Advisory
https://psytester.github.io/CVE-2019-13030/
Exploit
Third Party Advisory
https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md
Exploit
Third Party Advisory
https://psytester.github.io/CVE-2019-13030/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mediola:neo_server:*:*:*:*:*:*:*:*

Версия до 2.4.5 (исключая)

EPSS

Процентиль: 57%

0.00349

Низкий

8.2 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-425

Связанные уязвимости

GHSA-66j9-m56p-v3q3

github

больше 3 лет назад