CVE-2018-16494

{"id": "CVE-2018-16494", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-05-26T19:15:08.537", "references": [{"url": "https://hackerone.com/reports/1168191", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "In VOS and overly permissive \"umask\" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa servers."}, {"lang": "es", "value": "En VOS, un \"umask\" excesivamente permisivo puede permitir a usuarios autorizados del servidor conseguir acceso no autorizado mediante permisos de archivo no seguros que pueden resultar en una lectura, escritura o ejecuci\u00f3n arbitraria de archivos y directorios reci\u00e9n dise\u00f1ados. La configuraci\u00f3n umask no segura estaba presente en todos los servidores de Versa"}], "lastModified": "2021-06-04T15:04:11.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:versa-networks:versa_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E264C13-0CD8-49FB-868D-1CCF44906CDA", "versionEndExcluding": "16.1r2s11"}, {"criteria": "cpe:2.3:o:versa-networks:versa_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17ECACF2-A7D9-498F-AB4F-FEA707EC4D59", "versionEndExcluding": "20.2.2", "versionStartIncluding": "20.2.0"}, {"criteria": "cpe:2.3:o:versa-networks:versa_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D6FE42-92E1-4CBE-B1EC-AD4D017127CB", "versionEndExcluding": "21.1.1", "versionStartIncluding": "21.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}