2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:stalker:communigate_pro:6.2:*:*:*:*:*:*:*","matchCriteriaId":"F7885559-32A6-44CD-A2F3-E155762813B5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The \"XML Interface to Messaging, Scheduling, and Signaling\" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements."},{"lang":"es","value":"La implementación en el protocolo XIMSS (XML Interface to Messaging, Scheduling, and Signaling) en CommuniGate Pro (CGP) 6.2 sufre un ataque basado en la ausencia de validación del protocolo XIMSS que conduce a un ataque de suplantación de email, permitiendo a un atacante autenticado malicioso enviar un mensaje desde cualquier dirección de correo. El ataque utiliza una petición HTTP POST a la URI /Session e intercambia los elementos XML \"From\" y \"To\"."}],"id":"CVE-2018-3815","lastModified":"2026-06-17T01:57:50.243","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","version":"3.0"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-01-08T05:29:00.290","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"https://packetstormsecurity.com/files/145724/communigatepro62-spoof"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"https://packetstormsecurity.com/files/145724/communigatepro62-spoof"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"nvd@nist.gov","type":"Primary"}]}
|