CVE-2020-11614

{"id": "CVE-2020-11614", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2020-06-11T17:15:12.317", "references": [{"url": "https://github.com/Crytilis/mids-reborn-hero-designer/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.doyler.net/security-not-included/mids-reborn-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/Crytilis/mids-reborn-hero-designer/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.doyler.net/security-not-included/mids-reborn-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform file integrity validation for files after download. An attacker can perform a man-in-the-middle attack against this connection and replace executable files with malicious versions, which the operating system then executes under the context of the user running Hero Designer."}, {"lang": "es", "value": "Reborn Hero Designer de Mids versi\u00f3n 2.6.0.7 descarga el manifiesto de actualizaci\u00f3n, as\u00ed como los archivos de actualizaci\u00f3n, por medio de HTTP en texto sin cifrar. Adem\u00e1s, la aplicaci\u00f3n no lleva a cabo la comprobaci\u00f3n de integridad de los archivos despu\u00e9s de la descarga. Un atacante puede realizar un ataque de tipo man-in-the-middle contra esta conexi\u00f3n y reemplazar los archivos ejecutables con versiones maliciosas, que el sistema operativo ejecuta en el contexto del usuario que ejecuta Hero Designer"}], "lastModified": "2024-11-21T04:58:15.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mids\\'_reborn_hero_designer_project:mids\\'_reborn_hero_designer:2.6.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A59FBE0-3B0A-4845-9C09-958EB2C7C773"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}