CVE-2019-12782

{"id": "CVE-2019-12782", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2019-07-09T16:15:12.963", "references": [{"url": "https://docs.thoughtspot.com/5.1/release/notes.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vsecurity.com/download/advisories/201912782-1.txt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vsecurity.com/resources/advisories.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://docs.thoughtspot.com/5.1/release/notes.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vsecurity.com/download/advisories/201912782-1.txt", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vsecurity.com/resources/advisories.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at least one pinboard to corrupt pinboards of another user in the application by spoofing GUIDs in pinboard update requests, effectively deleting them."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en las actualizaciones de pinboard en ThoughtSpot versiones 4.4.1 hasta 5.1.1 (anteriores a 5.1.2), permite a un usuario con pocos privilegios, con acceso de escritura en al menos un pinboard, da\u00f1ar los pinboards de otro usuario en la aplicaci\u00f3n al falsificar los GUID en la petici\u00f3n de actualizaci\u00f3n de pinboard, elimin\u00e1ndolos efectivamente."}], "lastModified": "2024-11-21T04:23:34.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thoughtspot:thoughtspot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C14E56A1-D7B8-4024-AA22-2E9F3754EE8E", "versionEndIncluding": "5.1.1", "versionStartIncluding": "4.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}