CVE-2019-3415 - OpenCVE

ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files.

No CVSS v3.1

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:A/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Zte	Zxmw Nr8000 Zxmw Nr8000 Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:zte:zxmw_nr8000_firmware:2.4.4.03:::::::*
	cpe:2.3:o:zte:zxmw_nr8000_firmware:2.4.4.04:::::::*

cpe:2.3:h:zte:zxmw_nr8000:-:*:*:*:*:*:*:*

References

Link	Resource
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011082	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: zte

Published: 2019-07-11T20:50:03

Updated: 2019-07-11T20:50:03

Reserved: 2018-12-31T00:00:00

Link: CVE-2019-3415

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-07-11T21:15:09.810

Modified: 2019-07-17T18:18:00.793

Link: CVE-2019-3415

JSON object: View

Redhat Information

No data.

CWE

CWE-22

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxmw_nr8000_firmware:2.4.4.03:*:*:*:*:*:*:*", "matchCriteriaId": "19E05ACA-0A2E-4EFE-BEB8-A94CB5053C4C", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:zxmw_nr8000_firmware:2.4.4.04:*:*:*:*:*:*:*", "matchCriteriaId": "809FD9F6-5255-47FF-977B-D604BB9A4EBD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxmw_nr8000:-:*:*:*:*:*:*:*", "matchCriteriaId": "A12F3282-F363-4A61-9286-CB03B3AF4872", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files."}, {"lang": "es", "value": "Los dispositivos MW NR8000V2.4.4.03 y NR8000V2.4.4.04 de ZTE, se ven afectados por la vulnerabilidad de salto de ruta (path traversal). Debido a un salto de ruta, los usuarios pueden descargar cualquier archivo."}], "id": "CVE-2019-3415", "lastModified": "2019-07-17T18:18:00.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-07-11T21:15:09.810", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011082"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}