exploitDog

CVE-2021-40150

Опубликовано: 17 июл. 2022

Источник: nvd

CVSS3: 7.5

EPSS Средний

Описание

The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI.

Ссылки

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40150.txt
Exploit
Third Party Advisory
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40150.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:*

Версия до 3.0.0.716 (включая)

cpe:2.3:h:reolink:e1_zoom:-:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.34226

Средний

7.5 High

CVSS3

Дефекты

CWE-552

Связанные уязвимости

GHSA-7355-pc39-387f

CVSS3: 7.5

github

больше 3 лет назад

The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI.

EPSS

Процентиль: 97%

0.34226

Средний

7.5 High

CVSS3

Дефекты

CWE-552