CVE-2017-2101

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://jvn.jp/en/jp/JVN88176589/index.html	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/96261	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:ipa:appgoat:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-04-28 16:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-2101

Mitre link : CVE-2017-2101

CVE.ORG link : CVE-2017-2101

JSON object : View

Products Affected

ipa

appgoat

CWE

CWE-287

Improper Authentication

{"id": "CVE-2017-2101", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2017-04-28T16:59:00.730", "references": [{"url": "http://jvn.jp/en/jp/JVN88176589/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.securityfocus.com/bid/96261", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Hands-on Vulnerability Learning Tool \"AppGoat\" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors."}, {"lang": "es", "value": "La herramienta pr\u00e1ctica de aprendizaje sobre vulnerabilidades \"AppGoat\" para Web Aplication V3.0.0 y anteriores permite a los atacantes remotos anular la autenticaci\u00f3n para realizar operaciones arbitrarias a trav\u00e9s de vectores no especificados."}], "lastModified": "2017-05-05T13:23:15.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ipa:appgoat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BD24077-5A1D-45BD-9187-B44946D91A52", "versionEndIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}