CVE-2018-1000083

{"id": "CVE-2018-1000083", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-03-13T15:29:01.017", "references": [{"url": "https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the server."}, {"lang": "es", "value": "Ajenti, versi\u00f3n 2, contiene una vulnerabilidad de gesti\u00f3n incorrecta de errores en la petici\u00f3n JSON Login que puede resultar en que la requisici\u00f3n filtre una ruta del servidor. El ataque parece ser explotable ya que, al enviar un JSON mal formado, la herramienta responde con un error de traceback que filtra una ruta del servidor."}], "lastModified": "2024-11-21T03:39:36.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ajenti:ajenti:2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8536982E-2969-42F7-B702-59330A87046C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}