CVE-2013-5725

The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html	Exploit
http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:metaclassy:byword:2.0.0:::::::*
	cpe:2.3:a:metaclassy:byword:2.0.1:::::::*
	cpe:2.3:a:metaclassy:byword:2.0.2:::::::*
	cpe:2.3:a:metaclassy:byword:2.0.3:::::::*

History

21 Nov 2024, 01:58

Type	Values Removed	Values Added
References	~~() http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html - Exploit~~	() http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html - Exploit

Information

Published : 2013-10-01 00:55

Updated : 2024-11-21 01:58

NVD link : CVE-2013-5725

Mitre link : CVE-2013-5725

CVE.ORG link : CVE-2013-5725

JSON object : View

Products Affected

metaclassy

byword

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-5725", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-10-01T00:55:12.990", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2013-09/0145.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL."}, {"lang": "es", "value": "La aplicaci\u00f3n Metaclassy Byword 2.x (anteriores a 2.1) para iOS no requiere confirmaci\u00f3n para operaciones de archivo Replace, lo que permite a atacantes remotos sobreescribir archivos a discrecci\u00f3n a trav\u00e9s de los par\u00e1metros nombre y texto en una URL byword://replace"}], "lastModified": "2024-11-21T01:58:01.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:metaclassy:byword:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AF982AC-2BCF-4420-BFFC-38E4E2016476"}, {"criteria": "cpe:2.3:a:metaclassy:byword:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F458EEB-AC3E-4724-B167-6C28EFEF3DB4"}, {"criteria": "cpe:2.3:a:metaclassy:byword:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB905682-25A7-4B7B-91DB-0D105659B255"}, {"criteria": "cpe:2.3:a:metaclassy:byword:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65C0D0FB-B554-4472-9789-5A10317B1F34"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}