nvd-json-data-feeds/CVE-2019/CVE-2019-83xx/CVE-2019-8352.json

{
  "id": "CVE-2019-8352",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-05-20T19:29:00.393",
  "lastModified": "2024-11-21T04:49:44.500",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network."
    },
    {
      "lang": "es",
      "value": "Por defecto, BMC PATROL Agent hasta el 11.3.01 usa una Clave de Cifrado est\u00e1tica para cifrar / descifrar las credenciales de usuario enviadas a trav\u00e9s de la red a los servicios administrados de PATROL Agent. Si un atacante pudiera capturar este tr\u00e1fico de red, podr\u00eda descifrar estas credenciales y usarlas para ejecutar c\u00f3digo o escalar privilegios en la red."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bmc:patrol_agent:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "11.3.01",
              "matchCriteriaId": "5661BC21-383F-44E8-AEA6-F7A723545D08"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.securifera.com/advisories/CVE-2019-8352/",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.securifera.com/advisories/CVE-2019-8352/",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}