var-201405-0459
Vulnerability from variot
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the "guest" user. The issue lies in the ability the retrieve all project credentials. By abusing this flaw an attacker can disclose credentials and leverage this situation to achieve remote code execution. Ecava IntegraXor is a human interface product that uses HTML and SVG. Ecava IntegraXor has an unspecified error that allows an attacker to exploit a vulnerability to obtain sensitive account information. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Ecava IntegraXor is prone to an information-disclosure vulnerability. Versions prior to IntegraXor 4.1.4393 are vulnerable
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 1.6,
"vendor": "ecava",
"version": "4.1.4369"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 1.6,
"vendor": "ecava",
"version": "4.1.4360"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 1.6,
"vendor": "ecava",
"version": "4.1.4380"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 1.6,
"vendor": "ecava",
"version": "4.1.4340"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 1.6,
"vendor": "ecava",
"version": "4.1"
},
{
"_id": null,
"model": "integraxor",
"scope": null,
"trust": 1.4,
"vendor": "ecava",
"version": null
},
{
"_id": null,
"model": "integraxor",
"scope": "lte",
"trust": 1.0,
"vendor": "ecava",
"version": "4.1.4390"
},
{
"_id": null,
"model": "integraxor",
"scope": "lt",
"trust": 0.8,
"vendor": "ecava",
"version": "4.1.4393"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.6,
"vendor": "ecava",
"version": "4.x"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.6,
"vendor": "ecava",
"version": "4.1.4390"
},
{
"_id": null,
"model": "integraxor scada server",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "4.1.4392"
},
{
"_id": null,
"model": "integraxor scada server",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "4.1.4360"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.71.4200"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.60.4050"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.60.4032"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.60"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.6.4000.5"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.6.4000.0"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.5.4000.5"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.5.3900.5"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.5.3900.10"
},
{
"_id": null,
"model": "integraxor",
"scope": "eq",
"trust": 0.3,
"vendor": "ecava",
"version": "3.5"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "4.1"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "4.1.4340"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "4.1.4360"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "4.1.4369"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "4.1.4380"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "integraxor",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "BID",
"id": "69776"
},
{
"db": "BID",
"id": "66554"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
},
{
"db": "NVD",
"id": "CVE-2014-0786"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:ecava:integraxor",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
}
]
},
"credits": {
"_id": null,
"data": "Andrea Micalizzi (rgod)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-369"
}
],
"trust": 0.7
},
"cve": "CVE-2014-0786",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2014-0786",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2014-0786",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 1.4,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-02109",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "06e54bac-2352-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "ZDI",
"id": "CVE-2014-0786",
"trust": 1.4,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2014-0786",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-0786",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2014-02109",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201404-616",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
},
{
"db": "NVD",
"id": "CVE-2014-0786"
}
]
},
"description": {
"_id": null,
"data": "Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the \"guest\" user. The issue lies in the ability the retrieve all project credentials. By abusing this flaw an attacker can disclose credentials and leverage this situation to achieve remote code execution. Ecava IntegraXor is a human interface product that uses HTML and SVG. Ecava IntegraXor has an unspecified error that allows an attacker to exploit a vulnerability to obtain sensitive account information. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Ecava IntegraXor is prone to an information-disclosure vulnerability. \nVersions prior to IntegraXor 4.1.4393 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0786"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "BID",
"id": "69776"
},
{
"db": "BID",
"id": "66554"
},
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
}
],
"trust": 4.14
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2014-0786",
"trust": 5.2
},
{
"db": "ICS CERT",
"id": "ICSA-14-091-01",
"trust": 2.4
},
{
"db": "BID",
"id": "66554",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-02109",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-2310",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-14-369",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-2041",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-14-117",
"trust": 0.7
},
{
"db": "ICS CERT",
"id": "ICSA-14-224-01",
"trust": 0.3
},
{
"db": "BID",
"id": "69776",
"trust": 0.3
},
{
"db": "IVD",
"id": "06E54BAC-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "BID",
"id": "69776"
},
{
"db": "BID",
"id": "66554"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
},
{
"db": "NVD",
"id": "CVE-2014-0786"
}
]
},
"id": "VAR-201405-0459",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
}
],
"trust": 1.0713851600000002
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
}
]
},
"last_update_date": "2024-11-23T21:55:20.755000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Account Information Disclosure Vulnerability Note",
"trust": 0.8,
"url": "http://www.integraxor.com/blog/category/security/vulnerability-note/"
},
{
"title": "Ecava has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-224-01"
},
{
"title": "Ecava has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01"
},
{
"title": "Ecava IntegraXor Account Information Disclosure Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/44617"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-310",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "NVD",
"id": "CVE-2014-0786"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.1,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-091-01"
},
{
"trust": 1.6,
"url": "http://www.integraxor.com/blog/category/security/vulnerability-note/"
},
{
"trust": 1.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-14-224-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0786"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0786"
},
{
"trust": 0.6,
"url": "http://www.integraxor.com/blog/account-information-disclosure-vulnerability-note/"
},
{
"trust": 0.6,
"url": "http://www.integraxor.com/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
},
{
"db": "CNVD",
"id": "CNVD-2014-02109"
},
{
"db": "BID",
"id": "69776"
},
{
"db": "BID",
"id": "66554"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340"
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
},
{
"db": "NVD",
"id": "CVE-2014-0786"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-14-369",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-14-117",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2014-02109",
"ident": null
},
{
"db": "BID",
"id": "69776",
"ident": null
},
{
"db": "BID",
"id": "66554",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002340",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201404-616",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2014-0786",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2014-04-03T00:00:00",
"db": "IVD",
"id": "06e54bac-2352-11e6-abef-000c29c66e3d",
"ident": null
},
{
"date": "2014-10-24T00:00:00",
"db": "ZDI",
"id": "ZDI-14-369",
"ident": null
},
{
"date": "2014-05-02T00:00:00",
"db": "ZDI",
"id": "ZDI-14-117",
"ident": null
},
{
"date": "2014-04-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-02109",
"ident": null
},
{
"date": "2014-09-11T00:00:00",
"db": "BID",
"id": "69776",
"ident": null
},
{
"date": "2014-04-01T00:00:00",
"db": "BID",
"id": "66554",
"ident": null
},
{
"date": "2014-05-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002340",
"ident": null
},
{
"date": "2014-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201404-616",
"ident": null
},
{
"date": "2014-05-01T01:56:10.490000",
"db": "NVD",
"id": "CVE-2014-0786",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2014-10-24T00:00:00",
"db": "ZDI",
"id": "ZDI-14-369",
"ident": null
},
{
"date": "2014-05-02T00:00:00",
"db": "ZDI",
"id": "ZDI-14-117",
"ident": null
},
{
"date": "2014-05-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-02109",
"ident": null
},
{
"date": "2014-09-11T00:00:00",
"db": "BID",
"id": "69776",
"ident": null
},
{
"date": "2014-10-29T00:59:00",
"db": "BID",
"id": "66554",
"ident": null
},
{
"date": "2014-05-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002340",
"ident": null
},
{
"date": "2014-05-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201404-616",
"ident": null
},
{
"date": "2024-11-21T02:02:48.120000",
"db": "NVD",
"id": "CVE-2014-0786",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Ecava IntegraXor Guest Acccount Information Disclosure Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-369"
},
{
"db": "ZDI",
"id": "ZDI-14-117"
}
],
"trust": 1.4
},
"type": {
"_id": null,
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201404-616"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…