Search criteria

3 vulnerabilities found for web_p2p by dahuasecurity

FKIE_CVE-2020-9501

Vulnerability from fkie_nvd - Published: 2020-05-13 16:15 - Updated: 2024-11-21 05:40
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
References
cybersecurity@dahuatech.comhttps://www.dahuasecurity.com/support/cybersecurity/details/757Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.dahuasecurity.com/support/cybersecurity/details/757Vendor Advisory
Impacted products
Vendor Product Version
dahuasecurity web_p2p *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dahuasecurity:web_p2p:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A33A0B66-F9BC-4E68-867C-754385EFF2D3",
              "versionEndExcluding": "2020-04",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected."
    },
    {
      "lang": "es",
      "value": "Los atacantes pueden obtener informaci\u00f3n de Cloud Key del control Dahua Web P2P de formas espec\u00edficas. Cloud Key es usado para autenticar la conexi\u00f3n entre la herramienta del cliente y la plataforma. Un atacante puede usar el Cloud Key filtrado para suplantar al cliente para conectarse a la plataforma, lo que resulta en un consumo adicional de recursos del servidor de la plataforma. Las versiones con tiempo de Compilaci\u00f3n antes de abril de 2020 est\u00e1n afectadas."
    }
  ],
  "id": "CVE-2020-9501",
  "lastModified": "2024-11-21T05:40:47.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-05-13T16:15:13.200",
  "references": [
    {
      "source": "cybersecurity@dahuatech.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
    }
  ],
  "sourceIdentifier": "cybersecurity@dahuatech.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2020-9501 (GCVE-0-2020-9501)

Vulnerability from cvelistv5 – Published: 2020-05-13 15:17 – Updated: 2024-08-04 10:34
VLAI?
Summary
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
Severity ?
No CVSS data available.
CWE
  • Information leakage
Assigner
References
Impacted products
Vendor Product Version
n/a Web P2P control,P2P plartform server,client tools Affected: Versions which Build time before April,2020
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:39.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Web P2P control,P2P plartform server,client tools",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions which Build time before April,2020"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information leakage",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-13T15:17:20",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2020-9501",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Web P2P control,P2P plartform server,client tools",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions which Build time before April,2020"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information leakage"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/757",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2020-9501",
    "datePublished": "2020-05-13T15:17:20",
    "dateReserved": "2020-03-01T00:00:00",
    "dateUpdated": "2024-08-04T10:34:39.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-9501 (GCVE-0-2020-9501)

Vulnerability from nvd – Published: 2020-05-13 15:17 – Updated: 2024-08-04 10:34
VLAI?
Summary
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
Severity ?
No CVSS data available.
CWE
  • Information leakage
Assigner
References
Impacted products
Vendor Product Version
n/a Web P2P control,P2P plartform server,client tools Affected: Versions which Build time before April,2020
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:39.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Web P2P control,P2P plartform server,client tools",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions which Build time before April,2020"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information leakage",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-13T15:17:20",
        "orgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
        "shortName": "dahua"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@dahuatech.com",
          "ID": "CVE-2020-9501",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Web P2P control,P2P plartform server,client tools",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions which Build time before April,2020"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information leakage"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dahuasecurity.com/support/cybersecurity/details/757",
              "refsource": "MISC",
              "url": "https://www.dahuasecurity.com/support/cybersecurity/details/757"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79ee569e-7d1e-4364-98f0-3a18e2a739ad",
    "assignerShortName": "dahua",
    "cveId": "CVE-2020-9501",
    "datePublished": "2020-05-13T15:17:20",
    "dateReserved": "2020-03-01T00:00:00",
    "dateUpdated": "2024-08-04T10:34:39.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}