cnvd - cnvd-2016-11246

cnvd-2016-11246

Vulnerability from cnvd

Title

Lynxspring JENEsys BAS Bridge权限提升漏洞

Description

Lynxspring是一家美国公司。BAS Bridge是一个基于web的SCADA系统。BAS服务器部署的领域包括商业设施，制造业，能源，水和废水系统等等。 Lynxspring JENEsys BAS Bridge存在权限提升漏洞。攻击者利用漏洞以只读访问发送专门制作的命令到基于Web的应用程序，并在应用程序中进行更改。

Severity

高

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： http://www.lynxspring.com/technology/jenesys

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01

Impacted products

Name
Lynxspring BAS Bridge 1.1.8

Show details on source website

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94344"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8357"
    }
  },
  "description": "Lynxspring\u662f\u4e00\u5bb6\u7f8e\u56fd\u516c\u53f8\u3002BAS Bridge\u662f\u4e00\u4e2a\u57fa\u4e8eweb\u7684SCADA\u7cfb\u7edf\u3002BAS\u670d\u52a1\u5668\u90e8\u7f72\u7684\u9886\u57df\u5305\u62ec\u5546\u4e1a\u8bbe\u65bd\uff0c\u5236\u9020\u4e1a\uff0c\u80fd\u6e90\uff0c\u6c34\u548c\u5e9f\u6c34\u7cfb\u7edf\u7b49\u7b49\u3002\r\n\r\nLynxspring JENEsys BAS Bridge\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u4ee5\u53ea\u8bfb\u8bbf\u95ee\u53d1\u9001\u4e13\u95e8\u5236\u4f5c\u7684\u547d\u4ee4\u5230\u57fa\u4e8eWeb\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u5e76\u5728\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8fdb\u884c\u66f4\u6539\u3002",
  "discovererName": "Maxim Rupp",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttp://www.lynxspring.com/technology/jenesys",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11246",
  "openTime": "2016-11-17",
  "products": {
    "product": "Lynxspring BAS Bridge 1.1.8"
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01",
  "serverity": "\u9ad8",
  "submitTime": "2016-11-17",
  "title": "Lynxspring JENEsys BAS Bridge\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2016-8357 (GCVE-0-2016-8357)

Vulnerability from cvelistv5

Published

2017-02-13 21:00

Modified

2024-08-06 02:20

Severity ?

CWE

Lynxspring JENEsys BAS Bridge authorization bypass

Summary

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application.

References

URL

Tags

	http://www.securityfocus.com/bid/94344	vdb-entry, x_refsource_BID
	https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Lynxspring JENEsys BAS Bridge 1.1.8 and older	Version: Lynxspring JENEsys BAS Bridge 1.1.8 and older

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:20:31.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94344",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94344"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Lynxspring JENEsys BAS Bridge 1.1.8 and older",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Lynxspring JENEsys BAS Bridge 1.1.8 and older"
            }
          ]
        }
      ],
      "datePublic": "2017-02-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Lynxspring JENEsys BAS Bridge authorization bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-14T10:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "94344",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94344"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2016-8357",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Lynxspring JENEsys BAS Bridge 1.1.8 and older",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Lynxspring JENEsys BAS Bridge 1.1.8 and older"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Lynxspring JENEsys BAS Bridge authorization bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94344",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94344"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2016-8357",
    "datePublished": "2017-02-13T21:00:00",
    "dateReserved": "2016-09-28T00:00:00",
    "dateUpdated": "2024-08-06T02:20:31.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.