var-201712-0919
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter. TP-Link TL-SG108E Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The TP-LinkTL-SG108E is a Gigabit Ethernet switch from China's TP-LINK. Overview
Three vulnerabilities have been discovered in the TP-Link TL-SG108E, firmware 1.0.0 Build 20160722 Rel.50167: CVE-2017-17745 - Cross Site Scripting (XSS) in system_name_set.cgi, sysName parameter CVE-2017-17746 - Weak access control for user authentication CVE-2017-17747 - Weak access control for user logout
This is not an exhaustive list of vulnerabilities that may exist in the device firmware.
Device Overview
From http://www.tp-link.com.au/products/details/cat-41_TL-SG108E.html - "The TL-SG108E 8-Port Gigabit Easy Smart switch is an ideal upgrade from an unmanaged switch, designed for Small and Medium Business networks that require simple network management. Network administrators can effectively monitor traffic via Port Mirroring, Loop Prevention and Cable Diagnostics features."
Affected Devices
Firmware Version: 1.0.0 Build 20160722 Rel.50167 Hardware Version: TL-SG108E 3.0
Older TL-SG108E devices may also be affected.
Disclosure Timeline
September 08th, 2017 - Vulnerabilities discovered after purchasing the device. September 10th, 2017 - Contacted TP-Link via tp-link.com.au September 12th, 2017 - TP-Link responded, requesting further information September 12th, 2017 - Responded to TP-Link with vulnerability specifics. Advised a 90 day disclosure timeline, with offer to increase deadline if TP-Link wishes. September 12th -> October 16th - Emails back and forth discussing how to trigger the vulnerabilities. October 16th, 2017 - TP-Link confirms XSS vulnerability (CVE-2017-17745), advises an updated firmware will be released. TP-Link advises two remaining vulnerabilities (CVE-2017-17746, CVE-2017-17747) will not be fixed. December 18th, 2017 - Applied to Mitre for CVE numbers. December 19th, 2017 - Mitre assigned CVE-2017-17745, CVE-2017-17746, CVE-2017-17747 December 19th, 2017 - Public disclosure.
As of this date (December 19th, 2017), no updated firmware has been offered for testing, or released to the public.
Notes
In all examples below, the TL-SG108E was configured with a LAN IP address of 192.168.1.6. Many thanks to Simon @ TP-Link for the prompt email responses.
CVE-2017-17745 - Stored Cross Site Scripting (XSS)
- Device is not validating input to the script system_name_set.cgi on the TL-SG108E or on output to screen.
- Only the sysName variable in system_name_set.cgi was tested in this instance. Other fields in the management web-application may have similar problems, these were not tested.
Risks: * In some network configurations (such as behind a NAT router, as outlined in CVE-2017-17746) a malicious user could store XSS on the TL-SG108E and cause the administrator of the TL-SG108E to execute arbitrary javascript code in their browser.
Proof of Concept: * Authenticate to the device in a browser * Execute the following command from a terminal window: curl -vvvs -X 'GET' 'http://192.168.1.6/system_name_set.cgi?sysName=TL-SG"]};alert(1);' * To trigger the XSS: Browse -> System -> System Info. Alert box containing '1' displays, indicating successful javascript execution.
Mitigation: * Set the device password to a strong password. * Restrict access to the device from approved administrator workstations until an updated firmware is available.
CVE-2017-17746 - Weak access control
- All information regarding authenticated sessions is stored on the TL-SG108E, no cookies are sent from the device to the client after successful authentication.
Risks: * Any other browser on a PC which has authenticated, is then also treated as authenticated (Example: Login in Chrome, then open Firefox and browse to the TL-SG108E, and the session is already authenticated) * If the TL-SG108E is on the other side of a NAT router, ALL clients behind the NAT are treated as authenticated.
Steps to reproduce: * Authenticate from any PC. * Any other browser on that system is then able to access the web-interface without entering authentication information. * By extension, guest VMs on that machine are then automatically authenticated.
Mitigation: * Restrict access to the device from approved administrator workstations until an updated firmware is available. * Prevent any access to the web interface from devices behind a NAT router.
CVE-2017-17747 - Weak access control on Logout.htm
- Logout.htm can be called from any IP address, ending any authenticated sessions on the device.
Risks: * A denial of service condition can be triggered by calling the logout script in a loop from any machine on the network regardless of their authentication status, effectively making it impossible to access the TL-SG108E management web-application.
Steps to reproduce: * Authenticate from any PC. * From another PC with a different IP address, access the logout page (http://192.168.1.6/Logout.htm) * The session on the first PC has been terminated.
Mitigation: * Restrict access to the device from approved administrator workstations until an updated firmware is available.
-- End disclosure
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201712-0919",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tl-sg108e",
"scope": "eq",
"trust": 2.4,
"vendor": "tp link",
"version": "1.0.0"
},
{
"model": "tl-sg108e build rel.50167",
"scope": "eq",
"trust": 0.6,
"vendor": "tp link",
"version": "1.0.020160722"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:tp-link:tl-sg108e_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "James McLean",
"sources": [
{
"db": "PACKETSTORM",
"id": "145503"
}
],
"trust": 0.1
},
"cve": "CVE-2017-17745",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CVE-2017-17745",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-38109",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "VHN-108798",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.3,
"id": "CVE-2017-17745",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-17745",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-17745",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-38109",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201712-697",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-108798",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the \u0027sysName\u0027 parameter. TP-Link TL-SG108E Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The TP-LinkTL-SG108E is a Gigabit Ethernet switch from China\u0027s TP-LINK. Overview\n-------------\nThree vulnerabilities have been discovered in the TP-Link TL-SG108E,\nfirmware 1.0.0 Build 20160722 Rel.50167:\nCVE-2017-17745 - Cross Site Scripting (XSS) in system_name_set.cgi,\nsysName parameter\nCVE-2017-17746 - Weak access control for user authentication\nCVE-2017-17747 - Weak access control for user logout\n\nThis is not an exhaustive list of vulnerabilities that may exist in\nthe device firmware. \n\nDevice Overview\n-----------------------\n\u003eFrom http://www.tp-link.com.au/products/details/cat-41_TL-SG108E.html\n- \"The TL-SG108E 8-Port Gigabit Easy Smart switch is an ideal upgrade\nfrom an unmanaged switch, designed for Small and Medium Business\nnetworks that require simple network management. Network\nadministrators can effectively monitor traffic via Port Mirroring,\nLoop Prevention and Cable Diagnostics features.\"\n\nAffected Devices\n-----------------------\nFirmware Version: 1.0.0 Build 20160722 Rel.50167\nHardware Version: TL-SG108E 3.0\n\nOlder TL-SG108E devices may also be affected. \n\nDisclosure Timeline\n--------------------------\nSeptember 08th, 2017 - Vulnerabilities discovered after purchasing the device. \nSeptember 10th, 2017 - Contacted TP-Link via tp-link.com.au\nSeptember 12th, 2017 - TP-Link responded, requesting further information\nSeptember 12th, 2017 - Responded to TP-Link with vulnerability\nspecifics. Advised a 90 day disclosure timeline, with offer to\nincrease deadline if TP-Link wishes. \nSeptember 12th -\u003e October 16th - Emails back and forth discussing how\nto trigger the vulnerabilities. \nOctober 16th, 2017 - TP-Link confirms XSS vulnerability\n(CVE-2017-17745), advises an updated firmware will be released. \nTP-Link advises two remaining vulnerabilities (CVE-2017-17746,\nCVE-2017-17747) will not be fixed. \nDecember 18th, 2017 - Applied to Mitre for CVE numbers. \nDecember 19th, 2017 - Mitre assigned CVE-2017-17745, CVE-2017-17746,\nCVE-2017-17747\nDecember 19th, 2017 - Public disclosure. \n\nAs of this date (December 19th, 2017), no updated firmware has been\noffered for testing, or released to the public. \n\nNotes\n--------\nIn all examples below, the TL-SG108E was configured with a LAN IP\naddress of 192.168.1.6. \nMany thanks to Simon @ TP-Link for the prompt email responses. \n\nCVE-2017-17745 - Stored Cross Site Scripting (XSS)\n-------------------------------------------------------------------------\n* Device is not validating input to the script system_name_set.cgi on\nthe TL-SG108E or on output to screen. \n* Only the sysName variable in system_name_set.cgi was tested in this\ninstance. Other fields in the management web-application may have\nsimilar problems, these were not tested. \n\nRisks:\n* In some network configurations (such as behind a NAT router, as\noutlined in CVE-2017-17746) a malicious user could store XSS on the\nTL-SG108E and cause the administrator of the TL-SG108E to execute\narbitrary javascript code in their browser. \n\nProof of Concept:\n* Authenticate to the device in a browser\n* Execute the following command from a terminal window: curl -vvvs -X\n\u0027GET\u0027 \u0027http://192.168.1.6/system_name_set.cgi?sysName=TL-SG\"\\]\\};alert(1);\u003c/script\u003e\u0027\n* To trigger the XSS: Browse -\u003e System -\u003e System Info. Alert box\ncontaining \u00271\u0027 displays, indicating successful javascript execution. \n\nMitigation:\n* Set the device password to a strong password. \n* Restrict access to the device from approved administrator\nworkstations until an updated firmware is available. \n\nCVE-2017-17746 - Weak access control\n------------------------------------------------------\n* All information regarding authenticated sessions is stored on the\nTL-SG108E, no cookies are sent from the device to the client after\nsuccessful authentication. \n\nRisks:\n* Any other browser on a PC which has authenticated, is then also\ntreated as authenticated (Example: Login in Chrome, then open Firefox\nand browse to the TL-SG108E, and the session is already authenticated)\n* If the TL-SG108E is on the other side of a NAT router, ALL clients\nbehind the NAT are treated as authenticated. \n\nSteps to reproduce:\n* Authenticate from any PC. \n* Any other browser on that system is then able to access the\nweb-interface without entering authentication information. \n* By extension, guest VMs on that machine are then automatically authenticated. \n\nMitigation:\n* Restrict access to the device from approved administrator\nworkstations until an updated firmware is available. \n* Prevent any access to the web interface from devices behind a NAT router. \n\nCVE-2017-17747 - Weak access control on Logout.htm\n-------------------------------------------------------------------------\n* Logout.htm can be called from any IP address, ending any\nauthenticated sessions on the device. \n\nRisks:\n* A denial of service condition can be triggered by calling the logout\nscript in a loop from any machine on the network regardless of their\nauthentication status, effectively making it impossible to access the\nTL-SG108E management web-application. \n\nSteps to reproduce:\n* Authenticate from any PC. \n* From another PC with a different IP address, access the logout page\n(http://192.168.1.6/Logout.htm)\n* The session on the first PC has been terminated. \n\nMitigation:\n* Restrict access to the device from approved administrator\nworkstations until an updated firmware is available. \n\n--\nEnd disclosure",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17745"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "PACKETSTORM",
"id": "145503"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-17745",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-38109",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "145503",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-108798",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "PACKETSTORM",
"id": "145503"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"id": "VAR-201712-0919",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
}
],
"trust": 1.3142857000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
}
]
},
"last_update_date": "2024-11-23T22:34:26.300000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "TL-SG108E",
"trust": 0.8,
"url": "http://www.tp-link.in/products/details/cat-41_TL-SG108E.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://seclists.org/fulldisclosure/2017/dec/67"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17745"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17745"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17747"
},
{
"trust": 0.1,
"url": "http://www.tp-link.com.au/products/details/cat-41_tl-sg108e.html"
},
{
"trust": 0.1,
"url": "http://192.168.1.6/system_name_set.cgi?sysname=tl-sg\"\\]\\};alert(1);\u003c/script\u003e\u0027"
},
{
"trust": 0.1,
"url": "http://192.168.1.6/logout.htm)"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "PACKETSTORM",
"id": "145503"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "VULHUB",
"id": "VHN-108798"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"db": "PACKETSTORM",
"id": "145503"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"date": "2017-12-20T00:00:00",
"db": "VULHUB",
"id": "VHN-108798"
},
{
"date": "2018-01-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"date": "2017-12-20T01:35:37",
"db": "PACKETSTORM",
"id": "145503"
},
{
"date": "2017-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"date": "2017-12-20T20:29:00.217000",
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"date": "2018-01-05T00:00:00",
"db": "VULHUB",
"id": "VHN-108798"
},
{
"date": "2018-01-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-011615"
},
{
"date": "2017-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-697"
},
{
"date": "2024-11-21T03:18:34.563000",
"db": "NVD",
"id": "CVE-2017-17745"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TP-Link TL-SG108E Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-38109"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "145503"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-697"
}
],
"trust": 0.7
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…