8.7Alta
CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
Descripción
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.
Debilidad (CWE):
CWE-260
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| distribution | distribution | ≤ 5.4 | |
| minidvblinux | minidvblinux | ≤ 5.4 | |
| MiniDVBLinux | MiniDVBLinux(TM) Distribution (MLD) | <=5.4 |
Referencias y parches
- ExploitDB-51091 exploitExploitThird Party AdvisoryVDB Entry
- Official Product Homepage productProduct
- Zero Science Lab Disclosure (ZSL-2022-5713) third-party-advisoryExploitThird Party Advisory
- VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint third-party-advisoryThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:minidvblinux:minidvblinux:*:*:*:*:*:*:*:*≤ 5.4