CVE-2019-15849

{"id": "CVE-2019-15849", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "published": "2019-10-17T14:15:10.760", "references": [{"url": "https://noskill1337.github.io/homematic-ccu3-session-fixation", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.eq-3.com/products/homematic.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://noskill1337.github.io/homematic-ccu3-session-fixation", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.eq-3.com/products/homematic.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system."}, {"lang": "es", "value": "eQ-3 HomeMatic CCU3 firmware versi\u00f3n 3.41.11, permite la fijaci\u00f3n de la sesi\u00f3n. Un atacante puede crear IDs de sesi\u00f3n y enviarlos a la v\u00edctima. Despu\u00e9s de que la v\u00edctima se registra en la sesi\u00f3n, el atacante puede usar esa sesi\u00f3n. El atacante podr\u00eda crear inicios de sesi\u00f3n SSH despu\u00e9s de una sesi\u00f3n v\u00e1lida y comprometer f\u00e1cilmente el sistema."}], "lastModified": "2024-11-21T04:29:36.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.14.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74FC5540-61BD-463C-BAB5-BAC842036EAF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33113AD0-F378-49B2-BCFC-C57B52FD3A04"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}