CVE-2023-3349
Assigner: INCIBE
Published: 2023-10-03T13:24:44.830Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: IBERMATICA RPS 2019
vendor: IBERMATICA
versions: status: affected
version: RPS 2019
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Francisco Javier Medina Munuera
datePublic: 2023-06-29T10:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded.
value: Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: discovery: UNKNOWN
title: Information exposure on IBERMATICA RPS
x_generator: engine: Vulnogram 0.1.0-dev