8.7Hoch
CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
Beschreibung
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.
Schwachstellentyp (CWE):
CWE-260
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| distribution | distribution | ≤ 5.4 | |
| minidvblinux | minidvblinux | ≤ 5.4 | |
| MiniDVBLinux | MiniDVBLinux(TM) Distribution (MLD) | <=5.4 |
Referenzen und Patches
- ExploitDB-51091 exploitExploitThird Party AdvisoryVDB Entry
- Official Product Homepage productProduct
- Zero Science Lab Disclosure (ZSL-2022-5713) third-party-advisoryExploitThird Party Advisory
- VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:minidvblinux:minidvblinux:*:*:*:*:*:*:*:*≤ 5.4