CVE-2018-15869

{"id": "CVE-2018-15869", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-08-25T00:29:00.227", "references": [{"url": "http://www.securityfocus.com/bid/105172", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/hashicorp/packer/issues/6584", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog."}, {"lang": "es", "value": "Un desarrollador de Amazon Web Services (AWS) que no especifica la marca --owners al describir im\u00e1genes mediante la interfaz de l\u00ednea de comandos de AWS y que, por lo tanto, no valida correctamente el software de origen seg\u00fan las buenas pr\u00e1cticas de seguridad recomendadas por AWS, podr\u00eda cargar accidentalmente un AMI (Amazon Machine Image) no deseado y potencialmente malicioso desde el cat\u00e1logo AMI p\u00fablico de la comunidad sin organizar."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:packer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB1C5647-71D7-465B-9D25-228561B5791B", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}