Lucene search

MitreCVE-2023-36654

HistoryDec 12, 2023 - 1:15 a.m.

CVE-2023-36654

2023-12-1201:15:10

CWE-22

mitre

web.nvd.nist.gov

cve-2023-36654

directory traversal

prolion cryptospike

ssh private keys

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH private keys (associated with a Linux root user) by injecting paths inside REST API endpoint parameters.

Affected configurations

Nvd

Node

prolioncryptospikeMatch3.0.15p2

VendorProductVersionCPE
prolioncryptospike3.0.15cpe:2.3:a:prolion:cryptospike:3.0.15:p2:*:*:*:*:*:*

Vendor	Product	Version	CPE
prolion	cryptospike	3.0.15	cpe:2.3:a:prolion:cryptospike:3.0.15:p2::::::

References

www.cvcn.gov.it/cvcn/cve/CVE-2023-36654

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

Related for CVE-2023-36654