CVE-2018-1000205

{"id": "CVE-2018-1000205", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2018-06-26T16:29:00.307", "references": [{"url": "https://lists.denx.de/pipermail/u-boot/2018-June/330454.html", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.denx.de/pipermail/u-boot/2018-June/330898.html", "tags": ["Mitigation", "Mailing List", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality."}, {"lang": "es", "value": "U-Boot contiene una vulnerabilidad CWE-20: validaci\u00f3n de entradas incorrecta en la validaci\u00f3n de firma de arranque verificada que puede resultar en un arranque con la verificaci\u00f3n omitida. Este ataque parece ser explotable mediante una imagen FIT especialmente manipulada y una funcionalidad especial de la memoria del dispositivo."}], "lastModified": "2020-10-22T14:01:31.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F35CB70F-CD3F-4E4B-A967-40D090F9E070", "versionEndIncluding": "2018.07"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}