Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-1769
Vulnerability from csaf_certbund
Published
2024-08-05 22:00
Modified
2024-08-05 22:00
Summary
Hitachi Ops Center: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Hitachi Ops Center ist eine Softwarelösung für Rechenzentren zur Verwaltung, Optimierung, Orchestrierung und zum Schutz von Daten.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Hitachi Ops Center ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Hitachi Ops Center ist eine Softwarel\u00f6sung f\u00fcr Rechenzentren zur Verwaltung, Optimierung, Orchestrierung und zum Schutz von Daten.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Hitachi Ops Center ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1769 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1769.json" }, { "category": "self", "summary": "WID-SEC-2024-1769 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1769" }, { "category": "external", "summary": "Hitachi Software Vulnerability Information vom 2024-08-05", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-136/index.html" } ], "source_lang": "en-US", "title": "Hitachi Ops Center: Mehrere Schwachstellen erm\u00f6glichen nicht spezifizierten Angriff", "tracking": { "current_release_date": "2024-08-05T22:00:00.000+00:00", "generator": { "date": "2024-08-15T18:11:59.017+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2024-1769", "initial_release_date": "2024-08-05T22:00:00.000+00:00", "revision_history": [ { "date": "2024-08-05T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "Analyzer \u003c11.0.1-00", "product": { "name": "Hitachi Ops Center Analyzer \u003c11.0.1-00", "product_id": "T036614" } }, { "category": "product_version_range", "name": "Viewpoint \u003c11.0.2-00", "product": { "name": "Hitachi Ops Center Viewpoint \u003c11.0.2-00", "product_id": "T036615" } } ], "category": "product_name", "name": "Ops Center" } ], "category": "vendor", "name": "Hitachi" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-0482", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-0482" }, { "cve": "CVE-2023-24815", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-24815" }, { "cve": "CVE-2023-2974", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-2974" }, { "cve": "CVE-2023-32081", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-32081" }, { "cve": "CVE-2023-33546", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-33546" }, { "cve": "CVE-2023-4853", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Hitachi Ops Center, die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "release_date": "2024-08-05T22:00:00.000+00:00", "title": "CVE-2023-4853" } ] }
cve-2023-33546
Vulnerability from cvelistv5
Published
2023-06-01 00:00
Modified
2024-08-02 15:47
Severity ?
EPSS score ?
Summary
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input.
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-33546", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-05T20:51:44.224651Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-05T20:51:57.364Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T15:47:05.714Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/janino-compiler/janino/issues/201" }, { "tags": [ "x_transferred" ], "url": "https://janino-compiler.github.io/janino/#security" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2023-09-08T04:22:48.506397", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://github.com/janino-compiler/janino/issues/201" }, { "url": "https://janino-compiler.github.io/janino/#security" } ], "tags": [ "disputed" ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2023-33546", "datePublished": "2023-06-01T00:00:00", "dateReserved": "2023-05-22T00:00:00", "dateUpdated": "2024-08-02T15:47:05.714Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-32081
Vulnerability from cvelistv5
Published
2023-05-12 13:49
Modified
2024-08-02 15:03
Severity ?
EPSS score ?
Summary
Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.
References
▼ | URL | Tags |
---|---|---|
https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp | x_refsource_CONFIRM | |
https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b | x_refsource_MISC |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | vert-x3 | vertx-stomp |
Version: >= 3.1.0, < 3.9.16 Version: >= 4.0.0, < 4.4.2 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T15:03:29.081Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp" }, { "name": "https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "vertx-stomp", "vendor": "vert-x3", "versions": [ { "status": "affected", "version": "\u003e= 3.1.0, \u003c 3.9.16" }, { "status": "affected", "version": "\u003e= 4.0.0, \u003c 4.4.2" } ] } ], "descriptions": [ { "lang": "en", "value": "Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-05-12T13:49:56.969Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp" }, { "name": "https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b" } ], "source": { "advisory": "GHSA-gvrq-cg5r-7chp", "discovery": "UNKNOWN" }, "title": "Vert.x STOMP server process client frames that would not send initially a connect frame" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2023-32081", "datePublished": "2023-05-12T13:49:56.969Z", "dateReserved": "2023-05-01T16:47:35.316Z", "dateUpdated": "2024-08-02T15:03:29.081Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-2974
Vulnerability from cvelistv5
Published
2023-07-04 13:24
Modified
2024-08-02 06:41
Severity ?
EPSS score ?
Summary
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2023:3809 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-2974 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2211026 | issue-tracking, x_refsource_REDHAT |
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat build of Quarkus 2.13.8.Final |
Unaffected: 2.13.8.Final-redhat-00004 < * cpe:/a:redhat:quarkus:2.13 |
||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T06:41:03.976Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2023:3809", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:3809" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-2974" }, { "name": "RHBZ#2211026", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211026" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:quarkus:2.13" ], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-grpc", "product": "Red Hat build of Quarkus 2.13.8.Final", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.13.8.Final-redhat-00004", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:quarkus:2.13" ], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-vertx-http", "product": "Red Hat build of Quarkus 2.13.8.Final", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.13.8.Final-redhat-00004", "versionType": "rpm" } ] } ], "credits": [ { "lang": "en", "value": "This issue was discovered by Alexander Schwartz (Red Hat)." } ], "datePublic": "2023-06-29T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-757", "description": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-03T15:32:35.950Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2023:3809", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:3809" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-2974" }, { "name": "RHBZ#2211026", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211026" } ], "timeline": [ { "lang": "en", "time": "2023-05-30T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-06-29T00:00:00+00:00", "value": "Made public." } ], "title": "Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol", "x_redhatCweChain": "CWE-757: Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-2974", "datePublished": "2023-07-04T13:24:29.648Z", "dateReserved": "2023-05-30T10:06:53.993Z", "dateUpdated": "2024-08-02T06:41:03.976Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4853
Vulnerability from cvelistv5
Published
2023-09-20 09:47
Modified
2024-11-23 01:02
Severity ?
EPSS score ?
Summary
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Openshift Serverless 1 on RHEL 8 |
Unaffected: 0:1.9.2-3.el8 < * cpe:/a:redhat:serverless:1.0::el8 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:38:00.803Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2023:5170", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5170" }, { "name": "RHSA-2023:5310", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5310" }, { "name": "RHSA-2023:5337", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5337" }, { "name": "RHSA-2023:5446", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5446" }, { "name": "RHSA-2023:5479", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5479" }, { "name": "RHSA-2023:5480", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:5480" }, { "name": "RHSA-2023:6107", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:6107" }, { "name": "RHSA-2023:6112", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:6112" }, { "name": "RHSA-2023:7653", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7653" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4853" }, { "name": "RHSB-2023-002", "tags": [ "technical-description", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002" }, { "name": "RHBZ#2238034", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:serverless:1.0::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-clients", "product": "Openshift Serverless 1 on RHEL 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.9.2-3.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:optaplanner:::el6" ], "defaultStatus": "unaffected", "packageName": "quarkus-vertx-http", "product": "Red Hat build of OptaPlanner 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:quarkus:2.13" ], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-keycloak-authorization", "product": "Red Hat build of Quarkus 2.13.8.SP2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.13.8.Final-redhat-00005", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:quarkus:2.13" ], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-undertow", "product": "Red Hat build of Quarkus 2.13.8.SP2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.13.8.Final-redhat-00005", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:quarkus:2.13" ], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-vertx-http", "product": "Red Hat build of Quarkus 2.13.8.SP2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.13.8.Final-redhat-00005", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": [ "cpe:/a:redhat:camel_quarkus:2.13" ], "defaultStatus": "unaffected", "packageName": "quarkus-vertx-http", "product": "Red Hat Camel Extensions for Quarkus 2.13.3-1", "vendor": "Red Hat" }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/client-kn-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.9.2-3", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/ingress-rhel8-operator", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.1-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/knative-rhel8-operator", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.1-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-cli-artifacts-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.9.2-3", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/serverless-operator-bundle", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.1-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/serverless-rhel8-operator", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.1-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1/svls-must-gather-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.1-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.0-5", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1-tech-preview/logic-swf-builder-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.0-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_serverless:1.30::el8" ], "defaultStatus": "affected", "packageName": "openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8", "product": "Red Hat OpenShift Serverless 1.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.30.0-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhosemc:1.0::el8" ], "defaultStatus": "affected", "packageName": "rhpam-7/rhpam-kogito-builder-rhel8", "product": "RHEL-8 based Middleware Containers", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "7.13.4-3", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhosemc:1.0::el8" ], "defaultStatus": "affected", "packageName": "rhpam-7/rhpam-kogito-rhel8-operator", "product": "RHEL-8 based Middleware Containers", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "7.13.4-2", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhosemc:1.0::el8" ], "defaultStatus": "affected", "packageName": "rhpam-7/rhpam-kogito-rhel8-operator-bundle", "product": "RHEL-8 based Middleware Containers", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "7.13.4-2", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhosemc:1.0::el8" ], "defaultStatus": "affected", "packageName": "rhpam-7/rhpam-kogito-runtime-jvm-rhel8", "product": "RHEL-8 based Middleware Containers", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "7.13.4-3", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhosemc:1.0::el8" ], "defaultStatus": "affected", "packageName": "rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8", "product": "RHEL-8 based Middleware Containers", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "7.13.4-3", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": [ "cpe:/a:redhat:camel_k:1" ], "defaultStatus": "unaffected", "packageName": "quarkus-vertx-http", "product": "RHINT Camel-K-1.10.2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:service_registry:2.5" ], "defaultStatus": "unaffected", "packageName": "quarkus-vertx-http", "product": "RHINT Service Registry 2.5.4 GA", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13" ], "defaultStatus": "unaffected", "product": "RHPAM 7.13.4 async", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:jboss_enterprise_bpms_platform:7" ], "defaultStatus": "affected", "packageName": "quarkus-vertx-http", "product": "Red Hat Process Automation 7", "vendor": "Red Hat" } ], "datePublic": "2023-09-08T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-148", "description": "Improper Neutralization of Input Leaders", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T01:02:43.871Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2023:5170", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5170" }, { "name": "RHSA-2023:5310", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5310" }, { "name": "RHSA-2023:5337", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5337" }, { "name": "RHSA-2023:5446", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5446" }, { "name": "RHSA-2023:5479", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5479" }, { "name": "RHSA-2023:5480", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:5480" }, { "name": "RHSA-2023:6107", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:6107" }, { "name": "RHSA-2023:6112", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:6112" }, { "name": "RHSA-2023:7653", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7653" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4853" }, { "name": "RHSB-2023-002", "tags": [ "technical-description", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002" }, { "name": "RHBZ#2238034", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034" } ], "timeline": [ { "lang": "en", "time": "2023-09-08T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-09-08T00:00:00+00:00", "value": "Made public." } ], "title": "Quarkus: http security policy bypass", "workarounds": [ { "lang": "en", "value": "Use a \u2018deny\u2019 wildcard for base paths, then authenticate specifics within that:\n\nExamples:\n```\ndeny: /*\nauthenticated: /services/*\n```\nor\n```\ndeny: /services/*\nroles-allowed: /services/rbac/*\n```\n\nNOTE: Products are only vulnerable if they use (or allow use of) path-based HTTP policy configuration. Products may also be affected\u2013shipping the component in question\u2013without being vulnerable (\u201caffected at reduced impact\u201d).\n\nSee https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 for more detailed mitigations." } ], "x_redhatCweChain": "CWE-148: Improper Neutralization of Input Leaders" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-4853", "datePublished": "2023-09-20T09:47:32.150Z", "dateReserved": "2023-09-08T16:10:38.379Z", "dateUpdated": "2024-11-23T01:02:43.871Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-0482
Vulnerability from cvelistv5
Published
2023-02-17 00:00
Modified
2024-08-02 05:10
Severity ?
EPSS score ?
Summary
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T05:10:56.348Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20230427-0001/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "RESTEasy", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fixed in RESTEasy 4.7.8.Final" } ] } ], "descriptions": [ { "lang": "en", "value": "In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-378", "description": "CWE-378", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-27T00:00:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "url": "https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56" }, { "url": "https://security.netapp.com/advisory/ntap-20230427-0001/" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-0482", "datePublished": "2023-02-17T00:00:00", "dateReserved": "2023-01-24T00:00:00", "dateUpdated": "2024-08-02T05:10:56.348Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-24815
Vulnerability from cvelistv5
Published
2023-02-09 17:36
Modified
2024-08-02 11:03
Severity ?
EPSS score ?
Summary
Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T11:03:19.277Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38" }, { "name": "https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15" }, { "name": "https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "vertx-web", "vendor": "vert-x3", "versions": [ { "status": "affected", "version": "\u003e= 4.0.0, \u003c 4.3.8" } ] } ], "descriptions": [ { "lang": "en", "value": "Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return \"/\" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-02-09T17:36:32.589Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38" }, { "name": "https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/vert-x3/vertx-web/commit/9e3a783b1d1a731055e9049078b1b1494ece9c15" }, { "name": "https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83" } ], "source": { "advisory": "GHSA-53jx-vvf9-4x38", "discovery": "UNKNOWN" }, "title": "Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2023-24815", "datePublished": "2023-02-09T17:36:32.589Z", "dateReserved": "2023-01-30T14:43:33.704Z", "dateUpdated": "2024-08-02T11:03:19.277Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.