nvd-json-data-feeds/CVE-2021/CVE-2021-294xx/CVE-2021-29416.json

{
  "id": "CVE-2021-29416",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-03-29T18:15:13.407",
  "lastModified": "2022-07-12T17:42:04.277",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en PortSwigger Burp Suite versiones anteriores a 2021.2. Durante la visualizaci\u00f3n de una petici\u00f3n maliciosa, puede ser manipulado para emitir una petici\u00f3n que no respeta su configuraci\u00f3n de proxy ascendente. Esto podr\u00eda filtrar hashes NetNTLM en sistemas Windows que no bloquean un SMB saliente"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:portswigger:burp_suite:*:*:*:*:community:*:*:*",
              "versionEndExcluding": "2021.2",
              "matchCriteriaId": "42A66DAC-1D7D-4BFE-960E-A160B7AD3DAB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:portswigger:burp_suite:*:*:*:*:professional:*:*:*",
              "versionEndExcluding": "2021.2",
              "matchCriteriaId": "E8CA0D23-B6F2-4514-81CC-863480BD619E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://hackerone.com/reports/1054382",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://portswigger.net/burp/releases/professional-community-2020-12?requestededition=professional",
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}