CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.wdc.com/downloads.aspx?g=907&lang=en	Vendor Advisory
https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sandisk:ssd_dashboard::::::::
	cpe:2.3:a:westerndigital:ssd_dashboard::::::::

History

No history.

Information

Published : 2019-09-30 19:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-13467

Mitre link : CVE-2019-13467

CVE.ORG link : CVE-2019-13467

JSON object : View

Products Affected

westerndigital

ssd_dashboard

sandisk

ssd_dashboard

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-13467", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2019-09-30T19:15:08.713", "references": [{"url": "https://support.wdc.com/downloads.aspx?g=907&lang=en", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files."}, {"lang": "es", "value": "Descripci\u00f3n: Western Digital SSD Dashboard versiones anteriores a 2.5.1.0 y SanDisk SSD Dashboard versiones anteriores a 2.5.1.0, las aplicaciones son potencialmente vulnerables a los ataques de tipo man-in-the-middle cuando \u00e9stas descargan recursos del servicio web Dashboard. Esta vulnerabilidad puede permitir a un atacante sustituir los recursos descargados con archivos arbitrarios."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sandisk:ssd_dashboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EC82861-D69C-4257-844F-B9152504CCE5", "versionEndExcluding": "2.5.1.0"}, {"criteria": "cpe:2.3:a:westerndigital:ssd_dashboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B9A991A-D6AE-4A26-9594-16AF7CFBD5B9", "versionEndExcluding": "2.5.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}