CVE-2023-0506

The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md	Not Applicable
https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products	Third Party Advisory
https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md	Not Applicable
https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bydemes:airspace_cctv_web_service:2.616.by00.11:*:*:*:*:*:*:*

History

21 Nov 2024, 07:37

Type	Values Removed	Values Added
References	~~() https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md - Not Applicable~~	() https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md - Not Applicable
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products - Third Party Advisory~~	() https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products - Third Party Advisory

Information

Published : 2023-10-03 14:15

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0506

Mitre link : CVE-2023-0506

CVE.ORG link : CVE-2023-0506

JSON object : View

Products Affected

bydemes

airspace_cctv_web_service

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2023-0506", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-10-03T14:15:10.473", "references": [{"url": "https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md", "tags": ["Not Applicable"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://github.com/zerolynx/wstg/blob/master/document/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.md", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-demes-group-products", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access."}, {"lang": "es", "value": "El servicio web de ByDemes Group Airspace CCTV Web Service en su versi\u00f3n 2.616.BY00.11, contiene una vulnerabilidad de escalada de privilegios, detectada en el Panel de Control de C\u00e1maras, cuya explotaci\u00f3n podr\u00eda permitir a un atacante con pocos privilegios obtener acceso de administrador."}], "lastModified": "2024-11-21T07:37:18.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bydemes:airspace_cctv_web_service:2.616.by00.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC853657-76B9-41EC-AB9C-4C25D9501D69"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}