CVE-2023-36085 - Vulnerability Details - OpenCVE

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sisqualwfm	Sisqualwfm

Configuration 1 [-]

cpe:2.3:a:sisqualwfm:sisqualwfm:*:*:*:*:*:android:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html
https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-24T00:00:00

Updated: 2024-08-02T16:37:41.269Z

Reserved: 2023-06-21T00:00:00

Link: CVE-2023-36085

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-10-25T18:17:28.223

Modified: 2024-11-21T08:09:15.903

Link: CVE-2023-36085

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sisqualwfm:sisqualwfm:*:*:*:*:*:android:*:*", "matchCriteriaId": "2E2D8E46-F675-48EC-99D0-2F4A30BB9C32", "versionEndExcluding": "7.1.319.111", "versionStartIncluding": "7.1.319.103", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its \"/sisqualIdentityServer/core/\" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources."}, {"lang": "es", "value": "SisqualWFM 7.1.319.103 a 7.1.319.111 para Android tiene una vulnerabilidad de inyecci\u00f3n de encabezado de host en su endpoint \"/sisqualIdentityServer/core/\". Al modificar el encabezado del host HTTP, un atacante puede cambiar los enlaces de las p\u00e1ginas web e incluso redirigir a los usuarios a ubicaciones arbitrarias o maliciosas. Esto puede provocar ataques de phishing, distribuci\u00f3n de malware y acceso no autorizado a recursos confidenciales."}], "id": "CVE-2023-36085", "lastModified": "2024-11-21T08:09:15.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-25T18:17:28.223", "references": [{"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}