CNVD-2021-64035

Vulnerability from cnvd - Published: 2021-10-07
VLAI
Title
北京网御星云信息技术有限公司SSL VPN存在信息泄露漏洞
Description
北京网御星云信息技术有限公司由联想网御科技（北京）有限公司更名而来，业务涵盖网络边界安全防护、应用与数据安全防护、全网安全风险管理、专业安全解决方案和专业安全服务等多个方向。 北京网御星云信息技术有限公司SSL VPN存在信息泄露漏洞，攻击者可利用漏洞获取敏感信息。
Severity
中
Patch Name
北京网御星云信息技术有限公司SSL VPN存在信息泄露漏洞的补丁
Patch Description
北京网御星云信息技术有限公司由联想网御科技（北京）有限公司更名而来，业务涵盖网络边界安全防护、应用与数据安全防护、全网安全风险管理、专业安全解决方案和专业安全服务等多个方向。 北京网御星云信息技术有限公司SSL VPN存在信息泄露漏洞，攻击者可利用漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商已提供漏洞修补方案，建议用户下载使用： https://www.leadsec.com.cn/

Impacted products
Name
北京网御星云信息技术有限公司 SSL VPN
Show details on source website
To clipboard 

{
  "description": "\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8\u7531\u8054\u60f3\u7f51\u5fa1\u79d1\u6280\uff08\u5317\u4eac\uff09\u6709\u9650\u516c\u53f8\u66f4\u540d\u800c\u6765\uff0c\u4e1a\u52a1\u6db5\u76d6\u7f51\u7edc\u8fb9\u754c\u5b89\u5168\u9632\u62a4\u3001\u5e94\u7528\u4e0e\u6570\u636e\u5b89\u5168\u9632\u62a4\u3001\u5168\u7f51\u5b89\u5168\u98ce\u9669\u7ba1\u7406\u3001\u4e13\u4e1a\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u548c\u4e13\u4e1a\u5b89\u5168\u670d\u52a1\u7b49\u591a\u4e2a\u65b9\u5411\u3002\n\n\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8SSL VPN\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Eternit7",
  "formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u5efa\u8bae\u7528\u6237\u4e0b\u8f7d\u4f7f\u7528\uff1a\r\nhttps://www.leadsec.com.cn/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-64035",
  "openTime": "2021-10-07",
  "patchDescription": "\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8\u7531\u8054\u60f3\u7f51\u5fa1\u79d1\u6280\uff08\u5317\u4eac\uff09\u6709\u9650\u516c\u53f8\u66f4\u540d\u800c\u6765\uff0c\u4e1a\u52a1\u6db5\u76d6\u7f51\u7edc\u8fb9\u754c\u5b89\u5168\u9632\u62a4\u3001\u5e94\u7528\u4e0e\u6570\u636e\u5b89\u5168\u9632\u62a4\u3001\u5168\u7f51\u5b89\u5168\u98ce\u9669\u7ba1\u7406\u3001\u4e13\u4e1a\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u548c\u4e13\u4e1a\u5b89\u5168\u670d\u52a1\u7b49\u591a\u4e2a\u65b9\u5411\u3002\r\n\r\n\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8SSL VPN\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8SSL VPN\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8 SSL VPN"
  },
  "serverity": "\u4e2d",
  "submitTime": "2021-08-09",
  "title": "\u5317\u4eac\u7f51\u5fa1\u661f\u4e91\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8SSL VPN\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.