CVE-2020-8232 - OpenCVE

An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ui	Edgeswitch Firmware Ep-16-xg Ep-s16 Es-12f Es-16-150w Es-24-250w Es-24-500w Es-24-lite Es-48-500w Es-48-750w Es-48-lite Es-8-150w

Configuration 1 [-]

AND

cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:ui:ep-16-xg:-:::::::*
	cpe:2.3:h:ui:ep-s16:-:::::::*
	cpe:2.3:h:ui:es-12f:-:::::::*
	cpe:2.3:h:ui:es-16-150w:-:::::::*
	cpe:2.3:h:ui:es-24-250w:-:::::::*
	cpe:2.3:h:ui:es-24-500w:-:::::::*
	cpe:2.3:h:ui:es-24-lite:-:::::::*
	cpe:2.3:h:ui:es-48-500w:-:::::::*
	cpe:2.3:h:ui:es-48-750w:-:::::::*
	cpe:2.3:h:ui:es-48-lite:-:::::::*
	cpe:2.3:h:ui:es-8-150w:-:::::::*

No data.

References

Link	Providers
https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c
https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821
https://www.ui.com/download/edgemax

History

No history.

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2020-08-17T15:40:59

Updated: 2024-08-04T09:56:27.604Z

Reserved: 2020-01-28T00:00:00

Link: CVE-2020-8232

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-08-17T16:15:13.780

Modified: 2021-09-23T13:57:02.790

Link: CVE-2020-8232

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "EdgeSwitch firmware v1.9.0 and prior", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "Information Disclosure (CWE-200)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-17T15:40:59", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"}, {"tags": ["x_refsource_MISC"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ui.com/download/edgemax"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8232", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EdgeSwitch firmware v1.9.0 and prior", "version": {"version_data": [{"version_value": "Fixed in EdgeMax EdgeSwitch firmware v1.9.1"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure (CWE-200)"}]}]}, "references": {"reference_data": [{"name": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821", "refsource": "MISC", "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"}, {"name": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c", "refsource": "MISC", "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"}, {"name": "https://www.ui.com/download/edgemax", "refsource": "MISC", "url": "https://www.ui.com/download/edgemax"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:56:27.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ui.com/download/edgemax"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8232", "datePublished": "2020-08-17T15:40:59", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2024-08-04T09:56:27.604Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ui:edgeswitch_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "99D34145-C467-493B-8055-6CB58FE29C37", "versionEndExcluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ui:ep-16-xg:-:*:*:*:*:*:*:*", "matchCriteriaId": "AED6B48F-78E6-4BE2-A89C-36887E3CE63B", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:ep-s16:-:*:*:*:*:*:*:*", "matchCriteriaId": "C52B2CB9-844B-4720-BEC9-A73C9994C7AC", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-12f:-:*:*:*:*:*:*:*", "matchCriteriaId": "35E11BF8-2295-4DC3-B463-DC305B2ED456", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-16-150w:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD4B5024-6E26-4011-9392-26E304C0B00C", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-250w:-:*:*:*:*:*:*:*", "matchCriteriaId": "EBA2938D-8AF2-47D5-B881-AD27A999989D", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-500w:-:*:*:*:*:*:*:*", "matchCriteriaId": "2CDFD81A-C3D6-4B54-97C6-718FEB23C57C", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-24-lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "0085DBEE-368A-400D-A2E7-AC090CCD6324", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-500w:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7AC5ECE-A2E4-4AD8-B65D-4B5CFFF0A044", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-750w:-:*:*:*:*:*:*:*", "matchCriteriaId": "287F2ABB-2855-4938-A5F3-857744ABC4E6", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-48-lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C8A7623-0F2F-49F3-81F4-515E29A907EF", "vulnerable": false}, {"criteria": "cpe:2.3:h:ui:es-8-150w:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD0CDC1D-D5F7-437D-9544-95E8DBFBF1F7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el firmware EdgeMax EdgeSwitch versi\u00f3n v1.9.0, que permit\u00eda a unos usuarios de solo lectura poder obtener informaci\u00f3n no autorizada por medio de las p\u00e1ginas de una comunidad SNMP."}], "id": "CVE-2020-8232", "lastModified": "2021-09-23T13:57:02.790", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-17T16:15:13.780", "references": [{"source": "support@hackerone.com", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-9-1-v1-9-1/8a87dfc5-70f5-4055-8d67-570db1f5695c"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821"}, {"source": "support@hackerone.com", "tags": ["Product"], "url": "https://www.ui.com/download/edgemax"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "support@hackerone.com", "type": "Secondary"}]}