CVE-2018-17488

Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. By visiting the kiosk and accessing the print badge screen, an attacker could exploit this vulnerability using the command line to break out of kiosk mode.

CVSS v3 8.4 HIGH
CVSS v2.0 4.6 MEDIUM

8.4^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/149648	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/149648	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:jollytech:lobby_track:8.2.186:*:*:*:desktop:*:*:*

History

21 Nov 2024, 03:54

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/149648 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/149648 - Third Party Advisory, VDB Entry
CVSS	v2 : ~~4.6~~ v3 : ~~7.8~~	v2 : 4.6 v3 : 8.4

Information

Published : 2019-03-21 16:00

Updated : 2024-11-21 03:54

NVD link : CVE-2018-17488

Mitre link : CVE-2018-17488

CVE.ORG link : CVE-2018-17488

JSON object : View

Products Affected

jollytech

lobby_track

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-17488", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-03-21T16:00:25.170", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149648", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149648", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. By visiting the kiosk and accessing the print badge screen, an attacker could exploit this vulnerability using the command line to break out of kiosk mode."}, {"lang": "es", "value": "Lobby Track Desktop podr\u00eda permitir que un atacante local obtenga privilegios elevados en el sistema, provocado por un error en el di\u00e1logo de la impresora. Al visitar el quiosco y acceder a la pantalla de impresi\u00f3n de insignias, un atacante podr\u00eda explotar esta vulnerabilidad mediante la l\u00ednea de comandos para escapar del modo quiosco."}], "lastModified": "2024-11-21T03:54:31.783", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jollytech:lobby_track:8.2.186:*:*:*:desktop:*:*:*", "vulnerable": true, "matchCriteriaId": "0D33A548-CE2F-4CBD-A187-0C01D30713A2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}