CVE-2019-13915

b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/b3log/wide/issues/355	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:b3log:wide:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-07-18 15:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-13915

Mitre link : CVE-2019-13915

CVE.ORG link : CVE-2019-13915

JSON object : View

Products Affected

b3log

wide

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2019-13915", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-07-18T15:15:11.447", "references": [{"url": "https://github.com/b3log/wide/issues/355", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access."}, {"lang": "es", "value": "b3log Wide antes de 1.6.0 permite que tres tipos de ataques accedan a archivos arbitrarios. Primero, el atacante puede escribir c\u00f3digo en el editor, compilarlo y ejecutarlo aproximadamente tres veces para leer un archivo arbitrario. En segundo lugar, el atacante puede crear un enlace simb\u00f3lico y luego colocar el enlace simb\u00f3lico en un archivo ZIP. Una operaci\u00f3n de descomprimir conduce al acceso de lectura y al acceso de escritura (seg\u00fan los permisos de archivo) al objetivo de enlace simb\u00f3lico. En tercer lugar, el atacante puede importar un repositorio de Git que contenga un enlace simb\u00f3lico, lo que, de manera similar, conduce al acceso de lectura y escritura."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:b3log:wide:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02E20C3F-0298-4004-B2FB-FCBBA5508DD1", "versionEndExcluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}