CVE-2018-16307

{"id": "CVE-2018-16307", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-09-05T21:29:03.327", "references": [{"url": "http://packetstormsecurity.com/files/149196/MIWiFi-Xiaomi_55DD-2.8.50-Out-Of-Band-Resource-Load.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An \"Out-of-band resource load\" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response."}, {"lang": "es", "value": "Se ha detectado un problema de carga de recursos fuera de banda en dispositivos Xiaomi MIWiFi Xiaomi_55DD 2.8.50. Es posible hacer que la aplicaci\u00f3n recupere el contenido de una URL arbitraria externa y devuelva ese contenido en su propia respuesta. Si un nombre de dominio (que contiene una cadena aleatoria) se emplea en la cabecera HTTP Host, la aplicaci\u00f3n realiza una petici\u00f3n HTTP al dominio especificado. La respuesta de esa petici\u00f3n se incluye en la propia respuesta de la aplicaci\u00f3n."}], "lastModified": "2018-11-14T18:19:55.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mi:xiaomi_miwifi_xiaomi_55dd_firmware:2.8.50:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE09C2E7-0648-4A8D-8D32-FAE068175F27"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mi:xiaomi_miwifi_xiaomi_55dd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1104FB28-FA08-4E91-9A91-A292A5290F92"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}