CVE-2019-16951

{"id": "CVE-2019-16951", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-11-13T19:15:12.410", "references": [{"url": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses."}, {"lang": "es", "value": "Se descubri\u00f3 un problema de tipo remote file include (RFI) en Enghouse Web Chat versi\u00f3n 6.2.284.34. Uno puede reemplazar el atributo localhost con un nombre de dominio propio. Cuando el producto llama a este dominio luego que se env\u00eda la petici\u00f3n POST, recupera los datos de un atacante y los muestra. Tambi\u00e9n vale la pena mencionar la cantidad de informaci\u00f3n enviada en la petici\u00f3n desde este producto hacia un atacante: revela informaci\u00f3n que el p\u00fablico no deber\u00eda tener. Esto incluye nombres de ruta y direcciones IP internas."}], "lastModified": "2024-11-21T04:31:24.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADECAF52-1FE4-4CB5-8128-0855A26B4424"}, {"criteria": "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77214FC3-B6F4-4DB5-82E8-4198005F8C43"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}