CVE-2021-46354

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html	Third Party Advisory VDB Entry
http://thinfinity.com	Vendor Advisory
https://github.com/cybelesoft/virtualui/issues/3	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.28.0:::::::*
	cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.32.1:::::::*
	cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5.26.2:::::::*

History

No history.

Information

Published : 2022-02-09 14:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-46354

Mitre link : CVE-2021-46354

CVE.ORG link : CVE-2021-46354

JSON object : View

Products Affected

cybelesoft

thinfinity_virtualui

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2021-46354", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-02-09T14:15:07.793", "references": [{"url": "http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://thinfinity.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/cybelesoft/virtualui/issues/3", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter \"Addr\" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface."}, {"lang": "es", "value": "Thinfinity VirtualUI versiones 2.1.28.0, 2.1.32.1 y 2.5.26.2, corregido en la versi\u00f3n 3.0, est\u00e1 afectado por una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el par\u00e1metro \"Addr\" en el sitio cmd. La capacidad de enviar peticiones a otros sistemas puede permitir al servidor vulnerable filtrar la IP real del servidor web o aumentar la superficie de ataque"}], "lastModified": "2022-03-01T16:17:19.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.28.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E24716C8-13B0-4431-8BD4-45B9557333D7"}, {"criteria": "cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.32.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F215BC0D-F188-4ABC-ADE3-8CAD26A6F68A"}, {"criteria": "cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5.26.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11EB010C-71C8-4BAD-B131-BD73983E6734"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}