CVE-2019-19989

{"id": "CVE-2019-19989", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-02-26T16:15:18.597", "references": [{"url": "https://www.seling.it/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.seling.it/product/vam/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking for user identity and authorization."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Selesta Visual Access Manager (VAM) versiones 4.15.0 hasta 4.29. Varias p\u00e1ginas PHP, y otro tipo de archivos, son alcanzables por cualquier usuario sin comprobar su identidad y autorizaci\u00f3n."}], "lastModified": "2020-02-27T13:59:05.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:seling:visual_access_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1DDD534-B0DE-4F22-B69F-9971A8609AEF", "versionEndIncluding": "4.29.0", "versionStartIncluding": "4.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}