CVE-2019-9530

The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.9 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://kb.cert.org/vuls/id/719689/	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*

cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-10-10 20:15

Updated : 2021-10-26 20:17

NVD link : CVE-2019-9530

Mitre link : CVE-2019-9530

CVE.ORG link : CVE-2019-9530

JSON object : View

Products Affected

cobham

explorer_710
explorer_710_firmware

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2019-9530", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-10-10T20:15:11.270", "references": [{"url": "https://kb.cert.org/vuls/id/719689/", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory."}, {"lang": "es", "value": "El directorio root web del Cobham EXPLORER 710, versi\u00f3n de firmware 1.07, no presenta restricciones de acceso para descargar y leer todos los archivos. Esto podr\u00eda permitir que un atacante local no autenticado conectado al dispositivo acceda y descargue cualquier archivo encontrado en el directorio root web."}], "lastModified": "2021-10-26T20:17:51.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADA493F5-3AA0-4A1E-81CD-1AE01B9BD4D8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DEF6DB4B-2304-4E4C-92A1-BAF622E39BF1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}