CVE-2019-13410

TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://tvn.twcert.org.tw/taiwanvn/TVN-201907002	Third Party Advisory
https://www.twcert.org.tw/en/cp-128-3020-27eb5-2.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:topmeeting:topmeeting:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-10-17 20:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-13410

Mitre link : CVE-2019-13410

CVE.ORG link : CVE-2019-13410

JSON object : View

Products Affected

topmeeting

topmeeting

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2019-13410", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-10-17T20:15:12.050", "references": [{"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201907002", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/en/cp-128-3020-27eb5-2.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page."}, {"lang": "es", "value": "TOPMeeting versiones anteriores a 8.8 (19/08/2019) muestra la cuenta y la contrase\u00f1a de los asistentes en la p\u00e1gina front end que permite a un atacante obtener informaci\u00f3n confidencial mediante la navegaci\u00f3n del c\u00f3digo fuente de la p\u00e1gina."}], "lastModified": "2021-09-14T12:09:14.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:topmeeting:topmeeting:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "673E9BDA-0E12-46E0-91C6-71B4EDDD0F54", "versionEndExcluding": "8.8"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}