Musicloud 1.6 Wi-Fi Transfer downfiles/cur-folder information disclosure

wpiseditHistoryDiffjsonxmlCTI

Podatność, która została odkryta w Musicloud 1.6 (Cloud Software). Podatnością dotknięta jest nieznana funkcja w komponencie Wi-Fi Transfer. Nie są znane żadne środki zaradcze. Sugerowana jest zamiana podatnego komponentu na produkt alternatywny.

Timeline

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
8744806	2020-05-10	VulD...	discoverydate	1550361600		2020-05-10	accepted	100
8744855	2019-02-17	VulD...	cvss3_nvd_basescore	8.1	nist.gov	2019-02-17	accepted	90
8744854	2019-02-17	VulD...	cvss3_vuldb_rc	X		2019-02-17	accepted	90
8744853	2019-02-17	VulD...	cvss3_vuldb_rl	X		2019-02-17	accepted	90
8744852	2019-02-17	VulD...	cvss3_vuldb_e	X		2019-02-17	accepted	90
8744851	2019-02-17	VulD...	cvss2_vuldb_rc	ND		2019-02-17	accepted	90
8744850	2019-02-17	VulD...	cvss2_vuldb_rl	ND		2019-02-17	accepted	90
8744849	2019-02-17	VulD...	cvss2_vuldb_e	ND		2019-02-17	accepted	90
8744848	2019-02-17	VulD...	cve_nvd_summary	A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder (with a crafted ../ payload) to the download.script endpoint. This will create a MusicPlayerArchive.zip archive that is publicly accessible and includes the content of any requested file (such as the /etc/passwd file).	mitre.org	2019-02-17	accepted	100
8744847	2019-02-17	VulD...	cve_assigned	1550275200	mitre.org	2019-02-17	accepted	100
8744846	2019-02-17	VulD...	cve	CVE-2019-8389	mitre.org	2019-02-17	accepted	100
8744845	2019-02-17	VulD...	price_0day	$0-$5k	see documentation	2019-02-17	accepted	100
8744844	2019-02-17	VulD...	date	1550361600 (2019-02-17)		2019-02-17	accepted	100
8744843	2019-02-17	VulD...	cvss3_nvd_a	N	nist.gov	2019-02-17	accepted	100
8744842	2019-02-17	VulD...	cvss3_nvd_i	H	nist.gov	2019-02-17	accepted	100
8744841	2019-02-17	VulD...	cvss3_nvd_c	H	nist.gov	2019-02-17	accepted	100
8744840	2019-02-17	VulD...	cvss3_nvd_s	U	nist.gov	2019-02-17	accepted	100
8744839	2019-02-17	VulD...	cvss3_nvd_ui	N	nist.gov	2019-02-17	accepted	100
8744838	2019-02-17	VulD...	cvss3_nvd_pr	N	nist.gov	2019-02-17	accepted	100
8744837	2019-02-17	VulD...	cvss3_nvd_ac	L	nist.gov	2019-02-17	accepted	100