CVE-2015-7266

{"id": "CVE-2015-7266", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-10-30T17:29:00.517", "references": [{"url": "http://media.pixalate.com/white-papers/xindi.pdf", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cret@cert.org"}, {"url": "http://media.pixalate.com/white-papers/xindi.pdf", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentially compromise bid integrity by leveraging failure to limit the time between bid responses and impression notifications, aka the Amnesia Bug."}, {"lang": "es", "value": "La implementaci\u00f3n del protocolo OpenRTB 2.3 en Interactive Advertising Bureau (IAB) podr\u00eda permitir que atacantes remotos enmascaren el estado de las transacciones ad y comprometan la integridad de bid aprovechando el error a la hora de limitar el tiempo entre las respuestas bid y las notificaciones \"impression\". Esto tambi\u00e9n se conoce como \"Amnesia Bug\"."}], "lastModified": "2024-11-21T02:36:28.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iab:open_real-time_bidding:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB6D49D2-35D0-41A8-B5F1-43CA70067E83"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}