github - ghsa-2xvf-jhh8-xv4f

GHSA-2XVF-JHH8-XV4F

Vulnerability from github – Published: 2024-04-02 03:30 – Updated: 2024-04-02 03:30

Details

** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-3160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-02T03:15:19Z",
    "severity": "MODERATE"
  },
  "details": "** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.",
  "id": "GHSA-2xvf-jhh8-xv4f",
  "modified": "2024-04-02T03:30:44Z",
  "published": "2024-04-02T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3160"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netsecfish/intelbras_cap_js"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.258933"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.258933"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.305410"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-3160 (GCVE-0-2024-3160)

Vulnerability from cvelistv5 – Published: 2024-04-02 02:31 – Updated: 2024-08-26 14:36

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Information Disclosure

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.258933	vdb-entry
	https://vuldb.com/?ctiid.258933	signaturepermissions-required
	https://vuldb.com/?submit.305410	third-party-advisory
	https://github.com/netsecfish/intelbras_cap_js	exploit

Impacted products

Vendor

Product

Version

Intelbras

MHDX 1004

Affected: 20240401

Intelbras	MHDX 1008	Affected: 20240401
Intelbras	MHDX 1016	Affected: 20240401
Intelbras	MHDX 5016	Affected: 20240401
Intelbras	HDCVI 1008	Affected: 20240401
Intelbras	HDCVI 1016	Affected: 20240401

Credits

netsecfish (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:05:07.039Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VDB-258933 | Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.258933"
          },
          {
            "name": "VDB-258933 | CTI Indicators (IOB, IOC, TTP, IOA)",
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.258933"
          },
          {
            "name": "Submit #305410 | Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008, HDCVI 1016 N/A  Exposure of Sensitive Information to an Unauthorized Actor",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?submit.305410"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/netsecfish/intelbras_cap_js"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:intelbras:mhdx_1004_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mhdx_1004_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:intelbras:mhdx_1008_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mhdx_1008_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:intelbras:mhdx_1016_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mhdx_1016_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:intelbras:mhdx_5016_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mhdx_5016_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:intelbras:hdcvi_1008_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hdcvi_1008_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:intelbras:hdcvi_1016_firmware:20240401:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hdcvi_1016_firmware",
            "vendor": "intelbras",
            "versions": [
              {
                "status": "affected",
                "version": "20240401"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3160",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T14:06:12.963161Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T14:36:13.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "MHDX 1004",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        },
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "MHDX 1008",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        },
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "MHDX 1016",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        },
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "MHDX 5016",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        },
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "HDCVI 1008",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        },
        {
          "modules": [
            "HTTP GET Request Handler"
          ],
          "product": "HDCVI 1016",
          "vendor": "Intelbras",
          "versions": [
            {
              "status": "affected",
              "version": "20240401"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "netsecfish (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user."
        },
        {
          "lang": "de",
          "value": "Es wurde eine problematische Schwachstelle in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 bis 20240401 gefunden. Dabei betrifft es einen unbekannter Codeteil der Datei /cap.js der Komponente HTTP GET Request Handler. Durch Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Die wahre Existenz der vermeintlichen Schwachstelle wird zur Zeit in Frage gestellt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-02T02:31:04.579Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-258933 | Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.258933"
        },
        {
          "name": "VDB-258933 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.258933"
        },
        {
          "name": "Submit #305410 | Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008, HDCVI 1016 N/A  Exposure of Sensitive Information to an Unauthorized Actor",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.305410"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/netsecfish/intelbras_cap_js"
        }
      ],
      "tags": [
        "disputed"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2024-04-01T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2024-04-01T22:30:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-3160",
    "datePublished": "2024-04-02T02:31:04.579Z",
    "dateReserved": "2024-04-01T20:25:10.650Z",
    "dateUpdated": "2024-08-26T14:36:13.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2XVF-JHH8-XV4F

CVE-2024-3160 (GCVE-0-2024-3160)

Tags

Sightings

Nomenclature