CVE-2019-14222

{"id": "CVE-2019-14222", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-09-05T22:15:11.320", "references": [{"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco's Solr Web Admin Interface."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Alfresco Community Edition versiones 6.0 y anteriores. Un atacante remoto no autenticado podr\u00eda autenticarse en la Interfaz de Administraci\u00f3n Web Solr de Alfresco. La vulnerabilidad es debido a la presencia de una clave privada predeterminada que est\u00e1 presente en todas las instalaciones predeterminadas. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el uso de la clave privada extra\u00edda y empaquet\u00e1ndola en un PKCS12. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conseguir informaci\u00f3n sobre el sistema apuntado (por ejemplo, tipo de Sistema Operativo, ubicaciones de archivos del sistema, versi\u00f3n de Java, versi\u00f3n de Solr, etc.), as\u00ed como tambi\u00e9n la capacidad para activar nuevos ataques mediante el aprovechamiento del acceso a la Interfaz de Administraci\u00f3n Web Solr de Alfresco."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alfresco:alfresco:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "9378C003-2D84-40EF-89AF-7CFCE7EB353E", "versionEndIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}