CVE-2020-8232

An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c	Patch Release Notes Vendor Advisory
https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821	Vendor Advisory
https://www.ui.com/download/edgemax	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:ui:ep-16-xg:-:::::::*
	cpe:2.3:h:ui:ep-s16:-:::::::*
	cpe:2.3:h:ui:es-12f:-:::::::*
	cpe:2.3:h:ui:es-16-150w:-:::::::*
	cpe:2.3:h:ui:es-24-250w:-:::::::*
	cpe:2.3:h:ui:es-24-500w:-:::::::*
	cpe:2.3:h:ui:es-24-lite:-:::::::*
	cpe:2.3:h:ui:es-48-500w:-:::::::*
	cpe:2.3:h:ui:es-48-750w:-:::::::*
	cpe:2.3:h:ui:es-48-lite:-:::::::*
	cpe:2.3:h:ui:es-8-150w:-:::::::*

History

No history.

Information

Published : 2020-08-17 16:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-8232

Mitre link : CVE-2020-8232

CVE.ORG link : CVE-2020-8232

JSON object : View

Products Affected

ui

es-48-750w
es-8-150w
es-24-250w
edgeswitch_firmware
es-16-150w
ep-s16
es-24-500w
es-24-lite
ep-16-xg
es-48-500w
es-12f
es-48-lite

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2020-8232", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-08-17T16:15:13.780", "references": [{"url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "https://www.ui.com/download/edgemax", "tags": ["Product"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el firmware EdgeMax EdgeSwitch versi\u00f3n v1.9.0, que permit\u00eda a unos usuarios de solo lectura poder obtener informaci\u00f3n no autorizada por medio de las p\u00e1ginas de una comunidad SNMP."}], "lastModified": "2021-09-23T13:57:02.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37", "versionEndExcluding": "1.9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B"}, {"criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC"}, {"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456"}, {"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C"}, {"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D"}, {"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C"}, {"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324"}, {"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044"}, {"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6"}, {"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF"}, {"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "support@hackerone.com"}