2 lines
2.2 KiB
JSON
2 lines
2.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"botpress","repo":"https://github.com/botpress/botpress","vendor":"botpress","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"source":"vulnreport@tenable.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:botpress:botpress:-:*:*:*:*:*:*:*","matchCriteriaId":"29CC24E6-6AD5-4E66-8850-A3FE7E05C4FA","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'.\n\nWhen processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header.\n\nAn attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account."}],"id":"CVE-2026-4984","lastModified":"2026-08-18T18:04:53.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"vulnreport@tenable.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4984","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-27T14:37:47.846285Z","version":"2.0.3"}}]},"published":"2026-03-27T15:17:03.953","references":[{"source":"vulnreport@tenable.com","tags":["Third Party Advisory"],"url":"https://www.tenable.com/security/research/tra-2026-22"}],"sourceIdentifier":"vulnreport@tenable.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|