mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
281 lines
9.9 KiB
JSON
281 lines
9.9 KiB
JSON
{
|
|
"id": "CVE-2019-6543",
|
|
"sourceIdentifier": "ics-cert@hq.dhs.gov",
|
|
"published": "2019-02-13T01:29:00.333",
|
|
"lastModified": "2022-11-30T22:23:06.767",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "InduSoft Web Studio, en versiones anteriores a la 8.1 SP3 e InTouch Edge HMI (anteriormente conocido como InTouch Machine Edition), en versiones anteriores a la 2017 Update, de AVEVA Software, LLC. Se ejecuta c\u00f3digo con los privilegios en tiempo de ejecuci\u00f3n del programa, lo que podr\u00eda conducir al compromiso de la m\u00e1quina."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 5.9
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "LOW",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "COMPLETE",
|
|
"integrityImpact": "COMPLETE",
|
|
"availabilityImpact": "COMPLETE",
|
|
"baseScore": 10.0
|
|
},
|
|
"baseSeverity": "HIGH",
|
|
"exploitabilityScore": 10.0,
|
|
"impactScore": 10.0,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": false
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-306"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "ics-cert@hq.dhs.gov",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-306"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:6.1:sp5:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4C7C2429-3A6B-4552-B12D-CBA00563907D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:6.1:sp6_p3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "05020B8D-DB30-4BDA-9BD3-0C7C4804859B"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "55E9450D-F600-4DC6-8C72-8D79974B6802"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D2CB5BAC-BFCE-41C2-A25C-3E6CB218FBD6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FBFEECD4-C454-4A47-9B81-91699C325DC3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A62CC412-F399-40B7-8000-A4A707F7F6F1"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "127CC5C8-822A-4630-813E-5AE39BEBD5A2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "3D90DF6B-B281-48D3-8672-25294990E611"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "8721C8BE-1946-4030-B056-67A6B42BCDCA"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p4:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C07C446B-6125-46D7-BDC4-11849BA6A72D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p5:*:*:*:*:*:*",
|
|
"matchCriteriaId": "8D4A9403-5D1E-464F-8B40-D554F4A7C3AE"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p6:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FDFC8512-2971-48C3-9576-0FA74B59406B"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p7:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D2991440-E8EB-4AB1-A861-2A263C443DEF"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p8:*:*:*:*:*:*",
|
|
"matchCriteriaId": "23DA9BCB-F9BD-4F9F-A77E-95210C270539"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:7.1:sp3_p9:*:*:*:*:*:*",
|
|
"matchCriteriaId": "AD1C359C-61FA-4E5F-81CA-991BCB8CD9A8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D07A836A-535F-437E-BD25-1D833BD63327"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "AAD4BA73-691D-4E12-936C-7B0F0A0AFF0F"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:p2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D515729F-9316-470F-8D18-34B674E8F5D4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:p3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "542A2064-3D3D-4EF0-AEF5-3D8C45BD8CA6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:sp1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "3C282BFD-02D9-4F80-BBD9-B84B0703D07A"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:sp1_p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "92E5DA1B-459C-44B2-9E0B-2B88C985DA98"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:sp2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "186D0227-8791-44E0-8B80-2AE0427B69D7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.0:sp2_p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "DDA36D8C-6CE2-4C5B-A4E2-68031D97516D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.1:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F7B550C6-160F-480D-8B70-92C6D236C3EA"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.1:p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "2C809DC5-73DC-4E00-ABAB-558844CE2103"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.1:sp1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "BC7F3AAD-E423-4CA2-BB78-AC7B081338D3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.1:sp1_p1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "870D0F41-F2CE-4693-8815-5527A6E5ECD9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:indusoft_web_studio:8.1:sp2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "CBA02828-7756-4F12-9F3A-DBBD20AFEAF7"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:aveva:intouch_machine_edition_2014:r2:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "67AB4CF8-A2C6-4B0D-87EB-62617943F705"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01",
|
|
"source": "ics-cert@hq.dhs.gov",
|
|
"tags": [
|
|
"Third Party Advisory",
|
|
"US Government Resource"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.exploit-db.com/exploits/46342/",
|
|
"source": "ics-cert@hq.dhs.gov",
|
|
"tags": [
|
|
"Exploit",
|
|
"Third Party Advisory",
|
|
"VDB Entry"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.tenable.com/security/research/tra-2019-04",
|
|
"source": "ics-cert@hq.dhs.gov",
|
|
"tags": [
|
|
"Third Party Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |