CVE-2018-1000633

{"id": "CVE-2018-1000633", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2018-08-20T19:31:32.073", "references": [{"url": "http://www.openmicroscopy.org/2018/07/26/omero-5-4-7.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable via an attacker reading the web server log. This vulnerability appears to have been fixed in 5.4.7."}, {"lang": "es", "value": "Las versiones anteriores a la 5.4.7 de Open Microscopy Environment OMERO.web contienen una vulnerabilidad de exposici\u00f3n de informaci\u00f3n a trav\u00e9s de archivos de log en el formulario de inicio de sesi\u00f3n y en el formulario de cambio de contrase\u00f1a qeu puede resultar en la revelaci\u00f3n de la contrase\u00f1a de usuario. El atacante puede iniciar sesi\u00f3n como ese usuario. Este ataque parece ser explotable si la v\u00edctima lee el log del servidor web. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 5.4.7."}], "lastModified": "2018-10-12T19:49:21.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmicroscopy:omero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "789875DD-E63A-4EC9-A2A3-22F71F551284", "versionEndExcluding": "5.4.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}