8.7High
CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
Description
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.
Weakness (CWE):
CWE-260
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| distribution | distribution | ≤ 5.4 | |
| minidvblinux | minidvblinux | ≤ 5.4 | |
| MiniDVBLinux | MiniDVBLinux(TM) Distribution (MLD) | <=5.4 |
References and patches
- ExploitDB-51091 exploitExploitThird Party AdvisoryVDB Entry
- Official Product Homepage productProduct
- Zero Science Lab Disclosure (ZSL-2022-5713) third-party-advisoryExploitThird Party Advisory
- VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint third-party-advisoryThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:minidvblinux:minidvblinux:*:*:*:*:*:*:*:*≤ 5.4