CVE-2018-7296

{"id": "CVE-2018-7296", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-02-22T19:29:04.530", "references": [{"url": "http://atomic111.github.io/article/homematic-ccu2-fileread", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://atomic111.github.io/article/homematic-ccu2-fileread", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface."}, {"lang": "es", "value": "Salto de directorio/lectura de archivos arbitrarios en el m\u00e9todo User.getLanguage en eQ-3 AG Homematic CCU2, en versiones 2.29.2 y anteriores, permite que atacantes remotos lean la primera l\u00ednea de un archivo arbitrario en el sistema de archivos de CCU2. Esta vulnerabilidad podr\u00eda ser explotada por atacantes no autenticados con acceso a la interfaz web."}], "lastModified": "2024-11-21T04:11:57.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eq-3:homematic_central_control_unit_ccu2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65FE646C-A557-4FB1-8C74-655BF6820784", "versionEndIncluding": "2.29.22"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eq-3:homematic_central_control_unit_ccu2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "250E0A8B-A3F3-4A65-9C9D-8327EB1D99E5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}