CVE-2020-23036

{"id": "CVE-2020-23036", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2021-10-22T20:15:09.817", "references": [{"url": "https://cwe.mitre.org/data/definitions/522.html", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2211", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://cwe.mitre.org/data/definitions/522.html", "tags": ["Technical Description"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2211", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack."}, {"lang": "es", "value": "Se ha detectado que MEDIA NAVI Inc SMACom versi\u00f3n v1.2, contiene una vulnerabilidad de comprobaci\u00f3n de sesi\u00f3n no segura en el manejo de la sesi\u00f3n del par\u00e1metro de autenticaci\u00f3n \"password\" del m\u00f3dulo de transferencia de fotos por wifi. Esta vulnerabilidad permite a atacantes con privilegios de acceso a la red o en redes wifi p\u00fablicas leer las credenciales de autenticaci\u00f3n y las peticiones de seguimiento que contienen la contrase\u00f1a del usuario por medio de un ataque de tipo man in the middle"}], "lastModified": "2024-11-21T05:13:30.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:medianavi:smacom:1.2:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "D95313FA-C8E4-420A-BC56-363FD01D919C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}