mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-21 05:40:25 +00:00
added 2 CVEs, updated 6 CVEs
This commit is contained in:
Jochen Becker
parent
6b9c9719ae
commit
c8f94fe0b7
@ -99,7 +99,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
"value": "CWE-459 Incomplete Cleanup"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -124,4 +124,4 @@
|
||||
"value": "If no real-time communication from TwinCAT is required on the Ethernet interface, then users can alternatively re-configure them to use the Intel ® driver, which is shipped with Beckhoff images.\nCustomers should configure a perimeter firewall to block traffic from untrusted networks to the device, especially regarding ICMP and other small ethernet frames.\nBeckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,26 +1,15 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-12500",
|
||||
"ASSIGNER": "info@cert.vde.com",
|
||||
"DATE_PUBLIC": "2020-10-07T13:10:00.000Z",
|
||||
"TITLE": "Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "VDE-2020-040",
|
||||
"discovery": "EXTERNAL"
|
||||
"ID": "CVE-2020-12500",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Pepperl+Fuchs",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -28,31 +17,28 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT",
|
||||
"version_affected": "=",
|
||||
"version_value": "all",
|
||||
"platform": ""
|
||||
"version_name": "ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT",
|
||||
"version_value": "all"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "ES7510-XT",
|
||||
"version_affected": "<",
|
||||
"version_value": "2.1.1",
|
||||
"platform": ""
|
||||
"version_value": "2.1.1"
|
||||
},
|
||||
{
|
||||
"version_name": "ES8510",
|
||||
"version_affected": "<",
|
||||
"version_value": "3.1.1",
|
||||
"platform": ""
|
||||
"version_name": "ES8510",
|
||||
"version_value": "3.1.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"vendor_name": "Pepperl+Fuchs"
|
||||
},
|
||||
{
|
||||
"vendor_name": "Korenix",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -60,43 +46,38 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "5428G-20SFP",
|
||||
"version_affected": "<=",
|
||||
"version_value": "V1.0",
|
||||
"platform": ""
|
||||
"version_value": "V1.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "5810G",
|
||||
"version_affected": "<=",
|
||||
"version_value": "V1.1",
|
||||
"platform": ""
|
||||
"version_value": "V1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4706F",
|
||||
"version_affected": "<=",
|
||||
"version_value": "V2.3b",
|
||||
"platform": ""
|
||||
"version_value": "V2.3b"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4510",
|
||||
"version_affected": "<=",
|
||||
"version_value": "V3.0b",
|
||||
"platform": ""
|
||||
"version_value": "V3.0b"
|
||||
},
|
||||
{
|
||||
"version_name": "5310",
|
||||
"version_affected": "<",
|
||||
"version_value": "V1.6",
|
||||
"platform": ""
|
||||
"version_name": "5310",
|
||||
"version_value": "V1.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"vendor_name": "Korenix"
|
||||
},
|
||||
{
|
||||
"vendor_name": "Westermo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -104,86 +85,19 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "",
|
||||
"version_affected": "<",
|
||||
"version_value": "V1.8",
|
||||
"platform": ""
|
||||
"version_value": "V1.8"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"vendor_name": "Westermo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-863 Incorrect Authorization"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration."
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/de-de/advisories/vde-2020-040",
|
||||
"name": "https://cert.vde.com/de-de/advisories/vde-2020-040"
|
||||
},
|
||||
{
|
||||
"refsource": "FULLDISC",
|
||||
"url": "http://seclists.org/fulldisclosure/2021/Jun/0",
|
||||
"name": "20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html",
|
||||
"name": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/",
|
||||
"name": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"baseScore": 9.8,
|
||||
"baseSeverity": "CRITICAL"
|
||||
}
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."
|
||||
}
|
||||
],
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
@ -193,5 +107,81 @@
|
||||
"lang": "eng",
|
||||
"value": "Coordinated by CERT@VDE"
|
||||
}
|
||||
]
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.8,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-306 Missing Authentication for Critical Function"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://cert.vde.com/de-de/advisories/vde-2020-040",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/de-de/advisories/vde-2020-040"
|
||||
},
|
||||
{
|
||||
"name": "20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series",
|
||||
"refsource": "FULLDISC",
|
||||
"url": "http://seclists.org/fulldisclosure/2021/Jun/0"
|
||||
},
|
||||
{
|
||||
"name": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html",
|
||||
"refsource": "MISC",
|
||||
"url": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"
|
||||
},
|
||||
{
|
||||
"name": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "VDE-2020-040",
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -113,7 +113,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 version FW07 and prior versions. WAGO 750-831/xxx-xxx version FW07 and prior versions. WAGO 750-882 version FW07 and prior versions. WAGO 750-885/xxx-xxx version FW07 and prior versions. WAGO 750-889 version FW07 and prior versions."
|
||||
"value": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO 750-882, WAGO 750-885/xxx-xxx, WAGO 750-889 in versions FW07 and below."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -142,7 +142,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-287 Improper Authentication"
|
||||
"value": "CWE-306 Missing Authentication for Critical Function"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -113,7 +113,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version FW03 and prior versions. WAGO 750-823 version FW03 and prior versions. WAGO 750-832/xxx-xxx version FW03 and prior versions. WAGO 750-862 version FW03 and prior versions. WAGO 750-891 version FW03 and prior versions. WAGO 750-890/xxx-xxx version FW03 and prior versions."
|
||||
"value": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -142,7 +142,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-287 Improper Authentication"
|
||||
"value": "CWE-306 Missing Authentication for Critical Function"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -18,7 +18,7 @@
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "3.9R0.0",
|
||||
"version_name": "mbDIALUP",
|
||||
"version_value": "3.9R0.0"
|
||||
}
|
||||
]
|
||||
@ -73,7 +73,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-269 Improper Privilege Management"
|
||||
"value": "CWE-20 Improper Input Validation"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -85,7 +85,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
"value": "CWE-522 Insufficiently Protected Credentials"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,18 +1,116 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "info@cert.vde.com",
|
||||
"DATE_PUBLIC": "2021-11-10T11:00:00.000Z",
|
||||
"ID": "CVE-2021-34582",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Phoenix Contact: FL MGUARD XSS through web-based management and REST API"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FL MGUARD",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": ">=",
|
||||
"version_name": "FL MGUARD 1102 (No. 1153079)",
|
||||
"version_value": "1.4.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "FL MGUARD 1102 (No. 1153079)",
|
||||
"version_value": "1.5.0"
|
||||
},
|
||||
{
|
||||
"version_affected": ">=",
|
||||
"version_name": "FL MGUARD 1105 (No. 1153078)",
|
||||
"version_value": "1.4.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "FL MGUARD 1105 (No. 1153078)",
|
||||
"version_value": "1.5.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "PHOENIX CONTACT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.4,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross-site Scripting (XSS)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://cert.vde.com/en/advisories/VDE-2021-046/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/en/advisories/VDE-2021-046/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version)."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "VDE-2021-046",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "If an untrusted user may have exploited the vulnerability, it is recommended to revoke access for that user, and to re-upload the certificates on the Basic settings > LDAP and Logs > Remote logging pages through the REST API (i.e., without viewing these pages in the web-based management)."
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,122 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "info@cert.vde.com",
|
||||
"DATE_PUBLIC": "2021-11-10T11:00:00.000Z",
|
||||
"ID": "CVE-2021-34598",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Phoenix Contact: FL MGUARD lack of memory release in remote logging functionality"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FL MGUARD",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": ">=",
|
||||
"version_name": "FL MGUARD 1102 (No. 1153079)",
|
||||
"version_value": "1.4.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "FL MGUARD 1102 (No. 1153079)",
|
||||
"version_value": "1.5.0"
|
||||
},
|
||||
{
|
||||
"version_affected": ">=",
|
||||
"version_name": "FL MGUARD 1105 (No. 1153078)",
|
||||
"version_value": "1.4.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "FL MGUARD 1105 (No. 1153078)",
|
||||
"version_value": "1.5.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "PHOENIX CONTACT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This vulnerability was discovered by a key customer. We kindly appreciate the coordinated disclosure of this vulnerability by the finder."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-700 Allocation of Resources Without Limits or Throttling"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://cert.vde.com/en/advisories/VDE-2021-046/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/en/advisories/VDE-2021-046/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version)."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "VDE-2021-046",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "To prevent the possibility of an attack, it is recommended to deactivate remote logging."
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user