CVE-2020-15894

{"id": "CVE-2020-15894", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-07-22T19:15:12.710", "references": [{"url": "https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos D-Link DIR-816L versiones 2.x anteriores a 1.10b04Beta02. Se presenta una funci\u00f3n de administraci\u00f3n expuesta en el archivo getcfg.php, que puede ser utilizada para llamar a varios servicios. Puede ser usada por un atacante para recuperar informaci\u00f3n confidencial, tal y como credenciales de inicio de sesi\u00f3n de administrador, al establecer el valor de _POST_SERVICES en la cadena de consulta para DEVICE.ACCOUNT"}], "lastModified": "2023-11-08T22:49:55.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-816l_firmware:2.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1817EE29-D782-4A98-A478-20BDA559C5CE"}, {"criteria": "cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABE7E66F-20B2-4A39-A845-03E5FBBD9E2A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-816l:b1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "637B2D4B-0EA7-4E30-9B2B-77484D701042"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}