CVE-2019-17393

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

1.84%

Published

Oct 18, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-319CWE-522

Affected Products (1)

tomedo · servervulnerable

References (4)

http://packetstormsecurity.com/files/154873/Tomedo-Server-1.7.3-Information-Disclosure-Weak-Cryptography.html

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2019/Oct/33

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/154873/Tomedo-Server-1.7.3-Information-Disclosure-Weak-Cryptography.html

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2019/Oct/33

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs