CVE-2019-16067

{"id": "CVE-2019-16067", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-03-19T18:15:14.227", "references": [{"url": "https://www.mogozobo.com/?p=3647", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication traffic in transit."}, {"lang": "es", "value": "NETSAS Enigma NMS versiones 65.0.0 y anteriores, utiliza una autenticaci\u00f3n b\u00e1sica sobre HTTP para aplicar el control de acceso a la aplicaci\u00f3n web. El uso de una autenticaci\u00f3n d\u00e9bil transmitida por medio de protocolos de texto sin cifrar puede permitir a un atacante robar combinaciones de nombre de usuario y contrase\u00f1a al interceptar el tr\u00e1fico de autenticaci\u00f3n en tr\u00e1nsito."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netsas:enigma_network_management_solution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "220C0E41-42B3-4A8B-BBBB-F16BF22404B6", "versionEndIncluding": "65.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}