CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.

CVSS v3 7.4 HIGH
CVSS v2.0 5.8 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf	Patch Vendor Advisory
https://opcfoundation.org/security-bulletins/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:opcfoundation:netstandard.opc.ua::::::::
	cpe:2.3:a:opcfoundation:ua-.netstandard:1.4.357.28:::::::*

History

No history.

Information

Published : 2020-03-16 16:15

Updated : 2024-02-04 21:00

NVD link : CVE-2019-19135

Mitre link : CVE-2019-19135

CVE.ORG link : CVE-2019-19135

JSON object : View

Products Affected

opcfoundation

netstandard.opc.ua
ua-.netstandard

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2019-19135", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2020-03-16T16:15:11.937", "references": [{"url": "https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://opcfoundation.org/security-bulletins/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network."}, {"lang": "es", "value": "En las bases del c\u00f3digo OPC Foundation OPC UA .NET Standard versiones 1.4.357.28, los servidores no crean suficientemente n\u00fameros aleatorios en OPCFoundation.NetStandard.Opc.Ua versiones anteriores a 1.4.359.31, lo que permite a atacantes de tipo man in the middle reutilizar las credenciales de usuario cifradas enviadas a trav\u00e9s de la red."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opcfoundation:netstandard.opc.ua:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A04217C-169F-4EAD-B5E9-00BDBC3CB902", "versionEndExcluding": "1.4.359.31"}, {"criteria": "cpe:2.3:a:opcfoundation:ua-.netstandard:1.4.357.28:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A096F383-A1CE-4395-BC11-E9F2E706F4EA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}