CVE-2019-12753

{"id": "CVE-2019-12753", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2019-08-30T09:15:18.007", "references": [{"url": "https://support.symantec.com/us/en/article.SYMSA1489.html", "tags": ["Vendor Advisory"], "source": "secure@symantec.com"}, {"url": "https://support.symantec.com/us/en/article.SYMSA1489.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwords for external SMTP, FTP, FTPS, LDAP, and Cloud Log Download servers that they might not otherwise be authorized to access. The malicious administrator user can also obtain the passwords of other Reporter web UI users."}, {"lang": "es", "value": "Una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en Symantec Reporter web UI versiones 10.3 anteriores a 10.3.2.5, permite a un usuario administrador autenticado malicioso obtener contrase\u00f1as por servidores externos SMTP, FTP, FTPS, LDAP y Cloud Log Download a los que no estar\u00edan autorizados para acceder de otro modo. El usuario administrador malicioso tambi\u00e9n puede obtener las contrase\u00f1as de otros usuarios de Reporter web UI."}], "lastModified": "2024-11-21T04:23:30.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:reporter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81B9CBE6-70CF-482E-8871-414C62144FAA", "versionEndExcluding": "10.3.2.5", "versionStartIncluding": "10.3"}], "operator": "OR"}]}], "sourceIdentifier": "secure@symantec.com"}