CVE-2019-13915

{"id": "CVE-2019-13915", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-07-18T15:15:11.447", "references": [{"url": "https://github.com/b3log/wide/issues/355", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/b3log/wide/issues/355", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access."}, {"lang": "es", "value": "b3log Wide antes de 1.6.0 permite que tres tipos de ataques accedan a archivos arbitrarios. Primero, el atacante puede escribir c\u00f3digo en el editor, compilarlo y ejecutarlo aproximadamente tres veces para leer un archivo arbitrario. En segundo lugar, el atacante puede crear un enlace simb\u00f3lico y luego colocar el enlace simb\u00f3lico en un archivo ZIP. Una operaci\u00f3n de descomprimir conduce al acceso de lectura y al acceso de escritura (seg\u00fan los permisos de archivo) al objetivo de enlace simb\u00f3lico. En tercer lugar, el atacante puede importar un repositorio de Git que contenga un enlace simb\u00f3lico, lo que, de manera similar, conduce al acceso de lectura y escritura."}], "lastModified": "2024-11-21T04:25:41.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:b3log:wide:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02E20C3F-0298-4004-B2FB-FCBBA5508DD1", "versionEndExcluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}