CVE-2017-10669

{"id": "CVE-2017-10669", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2017-06-30T12:29:00.260", "references": [{"url": "http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html", "tags": ["Technical Description", "Third Party Advisory"], "source": "nvd@nist.gov"}, {"url": "http://seclists.org/fulldisclosure/2017/Jun/44", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs."}, {"lang": "es", "value": "Existe un envoltorio de firma en OSCI-Transport 1.2, tal y como se emplea en OSCI Transport Library 1.6.1 (Java) y OSCI Transport Library 1.6 (.NET). Un atacante con acceso a mensajes de protocolo OSCI no cifrados debe enviar mensajes de protocolo con ID duplicados."}], "lastModified": "2017-07-06T17:58:48.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xoev:osci_transport_library:1.6:*:*:*:.net:*:*:*", "vulnerable": true, "matchCriteriaId": "BC7159A3-28E0-4AE2-A2A5-7B5F44D7305F"}, {"criteria": "cpe:2.3:a:xoev:osci_transport_library:1.6.1:*:*:*:java:*:*:*", "vulnerable": true, "matchCriteriaId": "7F00B66D-46D7-4D58-A1A0-7BA1AD5C0EEE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}