CVE-2020-5784 - OpenCVE

Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Teltonika-networks	Trb245 Trb245 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:teltonika-networks:trb245_firmware:00.02.04.03:*:*:*:*:*:*:*

cpe:2.3:h:teltonika-networks:trb245:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.tenable.com/security/research/tra-2020-57	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: tenable

Published: 2020-10-01T19:36:33

Updated: 2020-10-01T19:36:33

Reserved: 2020-01-06T00:00:00

Link: CVE-2020-5784

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-10-01T20:15:13.783

Modified: 2020-10-01T23:19:58.200

Link: CVE-2020-5784

JSON object: View

Redhat Information

No data.

CWE

CWE-918

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:teltonika-networks:trb245_firmware:00.02.04.03:*:*:*:*:*:*:*", "matchCriteriaId": "7799652E-AF1F-4497-AE82-0BFD0C1F6377", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:teltonika-networks:trb245:-:*:*:*:*:*:*:*", "matchCriteriaId": "79D3CA40-99A7-4C3A-957E-E5E7A9BD11D4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Server-Side Request Forgery en el firmware de Teltonika TRB2_R_00.02.04.3, permite a un usuario poco privilegiado causar que la aplicaci\u00f3n lleve a cabo peticiones GET HTTP hacia unas URL arbitraria"}], "id": "CVE-2020-5784", "lastModified": "2020-10-01T23:19:58.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-01T20:15:13.783", "references": [{"source": "vulnreport@tenable.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tenable.com/security/research/tra-2020-57"}], "sourceIdentifier": "vulnreport@tenable.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}