CVE-2019-10689

{"id": "CVE-2019-10689", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-06-24T22:15:08.960", "references": [{"url": "http://www.securityfocus.com/bid/108799", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/insufficient-authentication-leakage-vvx-products.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information."}, {"lang": "es", "value": "Los productos VVX que utiliza el software UCS versi\u00f3n 5.9.2 y anteriores, con la aplicaci\u00f3n Better Together over Ethernet Connector (BToE) versi\u00f3n 3.9.1 y anteriores, proporcionan una autenticaci\u00f3n insuficiente entre la aplicaci\u00f3n BToE y el componente de BToE, lo que produce un filtrado de informaci\u00f3n confidencial."}], "lastModified": "2019-06-27T17:26:21.897", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:polycom:better_together_over_ethernet_connector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327C8311-C854-4D47-B09D-91B0C3DD643D", "versionEndIncluding": "3.9.1"}, {"criteria": "cpe:2.3:a:polycom:unified_communications_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3042ADDC-F1B9-42CF-8B0B-2F46AD40F3F8", "versionEndIncluding": "5.9.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}