8.7Yüksek
CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
Açıklama
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET request with 'action=getconfig' to retrieve a complete system configuration archive containing sensitive credentials.
Zayıflık türü (CWE):
CWE-260
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| distribution | distribution | ≤ 5.4 | |
| minidvblinux | minidvblinux | ≤ 5.4 | |
| MiniDVBLinux | MiniDVBLinux(TM) Distribution (MLD) | <=5.4 |
Kaynaklar ve yamalar
- ExploitDB-51091 exploitExploitThird Party AdvisoryVDB Entry
- Official Product Homepage productProduct
- Zero Science Lab Disclosure (ZSL-2022-5713) third-party-advisoryExploitThird Party Advisory
- VulnCheck Advisory: MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:minidvblinux:minidvblinux:*:*:*:*:*:*:*:*≤ 5.4