CVE-2023-6913

A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:imoulife:imou_life:6.7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-19 15:15

Updated : 2023-12-28 19:03

NVD link : CVE-2023-6913

Mitre link : CVE-2023-6913

CVE.ORG link : CVE-2023-6913

JSON object : View

Products Affected

imoulife

imou_life

CWE

CWE-384

Session Fixation

{"id": "CVE-2023-6913", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-12-19T15:15:09.447", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de secuestro de sesi\u00f3n en la aplicaci\u00f3n Imou Life que afecta a la versi\u00f3n 6.7.0. Esta vulnerabilidad podr\u00eda permitir a un atacante secuestrar cuentas de usuario debido a que la funcionalidad del c\u00f3digo QR no filtra correctamente los c\u00f3digos al escanear un nuevo dispositivo y ejecutar WebView directamente sin avisar ni mostrarlo al usuario. Esta vulnerabilidad podr\u00eda desencadenar ataques de phishing."}], "lastModified": "2023-12-28T19:03:17.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imoulife:imou_life:6.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A979E6CE-80D8-4A00-B14B-20BDEF1CD9A7"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}