CVE-2013-3539

Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://seclists.org/fulldisclosure/2013/Jun/84	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:ovislink:airlive_wl2600cam:-:::::::*
	cpe:2.3:h:sony:snc_ch140:-:::::::*
	cpe:2.3:h:sony:snc_ch180:-:::::::*
	cpe:2.3:h:sony:snc_ch240:-:::::::*
	cpe:2.3:h:sony:snc_ch280:-:::::::*
	cpe:2.3:h:sony:snc_dh140:-:::::::*
	cpe:2.3:h:sony:snc_dh140t:-:::::::*
	cpe:2.3:h:sony:snc_dh180:-:::::::*
	cpe:2.3:h:sony:snc_dh240:-:::::::*
	cpe:2.3:h:sony:snc_dh240t:-:::::::*
	cpe:2.3:h:sony:snc_dh280:-:::::::*

History

No history.

Information

Published : 2013-10-01 19:55

Updated : 2024-02-28 12:00

NVD link : CVE-2013-3539

Mitre link : CVE-2013-3539

CVE.ORG link : CVE-2013-3539

JSON object : View

Products Affected

sony

snc_dh180
snc_ch280
snc_dh240
snc_ch240
snc_ch180
snc_dh280
snc_dh140t
snc_dh240t
snc_dh140
snc_ch140

ovislink

airlive_wl2600cam

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2013-3539", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-10-01T19:55:03.507", "references": [{"url": "http://seclists.org/fulldisclosure/2013/Jun/84", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users."}, {"lang": "es", "value": "Vulnerabilidad Cross-site request forgery (CSRF) en command/user.cgi de Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, y posiblemente otros mod\u00e9los de cm\u00e1mara permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones de a\u00f1adir usuario."}], "lastModified": "2013-10-02T19:26:03.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ovislink:airlive_wl2600cam:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "047A5975-DB64-4A14-95E2-DE4C8767380C"}, {"criteria": "cpe:2.3:h:sony:snc_ch140:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F7EE6A1-1C2D-46AB-A2E5-BA337FEE5944"}, {"criteria": "cpe:2.3:h:sony:snc_ch180:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "886547A6-964B-4317-B87E-41E4A21E00F6"}, {"criteria": "cpe:2.3:h:sony:snc_ch240:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95967F17-022B-46AC-A9EA-F28029349B2C"}, {"criteria": "cpe:2.3:h:sony:snc_ch280:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D71CFC6B-07C7-42A4-A670-04E9BC2C7823"}, {"criteria": "cpe:2.3:h:sony:snc_dh140:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25DA6E7C-4FCE-4E3C-A8E9-9CE8F95382D0"}, {"criteria": "cpe:2.3:h:sony:snc_dh140t:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A32A946-AABA-4ED4-8937-D3529EA238D7"}, {"criteria": "cpe:2.3:h:sony:snc_dh180:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BBE3056-8EC1-48E9-876E-5C08D545D1E5"}, {"criteria": "cpe:2.3:h:sony:snc_dh240:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85F047FD-AA62-4B4E-B1F9-1572024FE115"}, {"criteria": "cpe:2.3:h:sony:snc_dh240t:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA03E7A7-30C7-4260-9DAE-01356A162654"}, {"criteria": "cpe:2.3:h:sony:snc_dh280:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD6859F4-615A-4623-A592-EACE0E4FE1CB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}