Chengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx karkarabe nderi encryption

Wuro vulnerability wey an yi classify sey karshewa an gano shi a cikin Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. Gaskiya, $software_function na da matsala; idan ba a sani ba, to wata aiki ce da ba a sani ba, $software_library na cikin lissafi, /Service/ImageStationDataService.asmx na cikin fayil, File Name Handler na cikin sashi. Ngam manipulation shi karkarabe nderi encryption. CWE shidin ka a yi bayani matsala sai ya kai CWE-330. Gaskiya, laifi an fitar da shi 07/20/2023. Advisory ɗin ana rabawa don saukewa a github.com. Wannan rauni ana sayar da shi da suna CVE-2023-3803. Wuro ndiyam na local network ɗin sai a samu kafin wannan hari ya yi nasara. Tekinikal bayani ga. Kuma, exploit ɗin yana akwai. Wuro exploit ɗin an bayyana shi ga jama'a kuma za a iya amfani da shi. A sa'i, exploit might be approx. USD $0-$5k ndiyam. Á wúro huɗɗi-na-gaskiya. Wona yiwuwa a zazzage exploit a github.com. Kama 0-day, an ndiyam a wuro be $0-$5k. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

2 Goyarwa · 44 Datenpunkte

FurɗeSúgá
07/20/2023 10:33		Gargadi 1/1
08/15/2023 12:02
exploit_urlhttps://github.com/GUIqizsq/cve/blob/main/upload_2.mdhttps://github.com/GUIqizsq/cve/blob/main/upload_2.md
source_cveCVE-2023-3803CVE-2023-3803
cna_responsibleVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
software_vendorChengduChengdu
software_nameFlash Flood Disaster Monitoring and Warning SystemFlash Flood Disaster Monitoring and Warning System
software_version2.02.0
software_componentFile Name HandlerFile Name Handler
software_file/Service/ImageStationDataService.asmx/Service/ImageStationDataService.asmx
vulnerability_cweCWE-330 (karkarabe nderi encryption)CWE-330 (karkarabe nderi encryption)
vulnerability_risk11
cvss3_vuldb_acHH
cvss3_vuldb_uiNN
cvss3_vuldb_sUU
cvss3_vuldb_cLL
cvss3_vuldb_iNN
cvss3_vuldb_aNN
cvss3_vuldb_ePP
cvss3_vuldb_rcRR
advisory_urlhttps://github.com/GUIqizsq/cve/blob/main/upload_2.mdhttps://github.com/GUIqizsq/cve/blob/main/upload_2.md
exploit_availability11
exploit_publicity11
advisory_date1689804000 (07/20/2023)1689804000 (07/20/2023)
cvss2_vuldb_acHH
cvss2_vuldb_ciPP
cvss2_vuldb_iiNN
cvss2_vuldb_aiNN
cvss2_vuldb_ePOCPOC
cvss2_vuldb_rcURUR
cvss2_vuldb_avAA
cvss2_vuldb_auSS
cvss2_vuldb_rlNDND
cvss3_vuldb_avAA
cvss3_vuldb_prLL
cvss3_vuldb_rlXX
cvss2_vuldb_basescore1.41.4
cvss2_vuldb_tempscore1.21.2
cvss3_vuldb_basescore2.62.6
cvss3_vuldb_tempscore2.42.4
cvss3_meta_basescore2.62.6
cvss3_meta_tempscore2.42.4
price_0day$0-$5k$0-$5k
cve_assigned1689804000 (07/20/2023)
cve_nvd_summaryA vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

◂ GurɗoGumtiGada ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!