CVE-2019-16133

{"id": "CVE-2019-16133", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-09-09T03:15:10.577", "references": [{"url": "http://www.iwantacve.cn/index.php/archives/271/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.iwantacve.cn/index.php/archives/271/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en eteams OA v4.0.34. Debido a que la sesi\u00f3n no se verifica estrictamente, los nombres de cuenta y las contrase\u00f1as de todos los empleados de la empresa pueden obtenerse mediante una cuenta ordinaria. Espec\u00edficamente, el atacante env\u00eda un valor jsessionid para los URI en aplicaci\u00f3n / perfil / resumen"}], "lastModified": "2024-11-21T04:30:07.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weaver:eteams_oa:4.0.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F074453C-7F63-4E36-9DC3-F19ACD43E61D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}