CVE-2019-9102 - OpenCVE

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Moxa	Mb3280 Firmware Mb3660 Mb3660 Firmware Mb3170 Firmware Mb3480 Mb3480 Firmware Mb3180 Mb3280 Mb3270 Mb3180 Firmware Mb3170 Mb3270 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:moxa:mb3170_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3170:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:moxa:mb3270_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3270:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:moxa:mb3180_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3180:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:moxa:mb3280_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3280:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:moxa:mb3480_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3480:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:moxa:mb3660_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:moxa:mb3660:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities	Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-056-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-03-11T14:27:58

Updated: 2020-03-11T14:27:58

Reserved: 2019-02-24T00:00:00

Link: CVE-2019-9102

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-03-11T15:15:17.077

Modified: 2021-07-21T11:39:23.747

Link: CVE-2019-9102

JSON object: View

Redhat Information

No data.

CWE

CWE-330

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-09-25T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AC:L/AV:N/A:L/C:N/I:L/PR:N/S:U/UI:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-11T14:27:58", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9102", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AC:L/AV:N/A:L/C:N/I:L/PR:N/S:U/UI:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}, {"name": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities", "refsource": "CONFIRM", "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9102", "datePublished": "2020-03-11T14:27:58", "dateReserved": "2019-02-24T00:00:00", "dateUpdated": "2020-03-11T14:27:58", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3170_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA77E3A9-35F8-46C1-B8DE-9647AFD61639", "versionEndIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3170:-:*:*:*:*:*:*:*", "matchCriteriaId": "02331350-F101-4848-ACC8-128F71158A2B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3270_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "320E0EA8-031F-4FB5-A31E-383CBAB1A7B7", "versionEndIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3270:-:*:*:*:*:*:*:*", "matchCriteriaId": "5B20B91C-1A84-4B6B-9057-ABC2374E749B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3180_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0627A8C8-E7D1-4005-BA45-DD5713A66974", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3180:-:*:*:*:*:*:*:*", "matchCriteriaId": "4CF26E0E-2E1A-4365-8F7D-E668A2856F57", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3280_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE9A7F7F-B24E-40D6-9316-1BC67A826D22", "versionEndIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3280:-:*:*:*:*:*:*:*", "matchCriteriaId": "706A1768-5776-48CC-A4ED-1F73841C9F9A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3480_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "21613C9B-C822-4B51-98D5-88C4A0B7F852", "versionEndIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3480:-:*:*:*:*:*:*:*", "matchCriteriaId": "9B9256FD-5121-4009-8672-D9637053E808", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:moxa:mb3660_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "634112A7-C567-43E8-BB61-73779CB43C6D", "versionEndIncluding": "2.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:moxa:mb3660:-:*:*:*:*:*:*:*", "matchCriteriaId": "1DC4BC5A-4EDA-448B-B312-C9A9F906E4DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos Moxa MGate MB3170 y MB3270 versiones anteriores a la versi\u00f3n 4.1, en los dispositivos MB3280 y MB3480 versiones anteriores a la versi\u00f3n 3.1, en los dispositivos MB3660 versiones anteriores a la versi\u00f3n 2.3 y en los dispositivos MB3180 versiones anteriores a la versi\u00f3n 2.1. Un mecanismo predecible de generaci\u00f3n de tokens permite a atacantes remotos omitir el mecanismo de protecci\u00f3n de ataques de tipo cross-site request forgery (CSRF)."}], "id": "CVE-2019-9102", "lastModified": "2021-07-21T11:39:23.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "cve@mitre.org", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-11T15:15:17.077", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.moxa.com/en/support/support/security-advisory/mb3710-3180-3270-3280-3480-3660-vulnerabilities"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-056-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "nvd@nist.gov", "type": "Primary"}]}