Lucene search

MitreCVE-2019-8919

HistoryFeb 18, 2019 - 8:29 p.m.

CVE-2019-8919

2019-02-1820:29:00

CWE-330

mitre

web.nvd.nist.gov

seadroid

seafile android client

cve-2019-8919

encryption

chosen-plaintext attacks

dictionary attacks

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.

Affected configurations

Nvd

Node

seafileseadroidRange≤2.2.13android

VendorProductVersionCPE
seafileseadroid*cpe:2.3:a:seafile:seadroid:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
seafile	seadroid	*	cpe:2.3:a:seafile:seadroid::::::android::*

References

github.com/haiwen/seadroid/issues/789

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVE-2019-8919