CVE-2023-6317 - OpenCVE

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/
https://lgsecurity.lge.com/bulletins/tv#updateDetails

History

No history.

MITRE

Status: PUBLISHED

Assigner: Bitdefender

Published: 2024-04-09T13:41:34.843Z

Updated: 2024-08-02T08:28:21.578Z

Reserved: 2023-11-27T14:21:53.117Z

Link: CVE-2023-6317

Vulnrichment

Updated: 2024-08-02T08:28:21.578Z

NVD

Status : Awaiting Analysis

Published: 2024-04-09T14:15:07.683

Modified: 2024-04-18T08:15:37.663

Link: CVE-2023-6317

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6317", "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "state": "PUBLISHED", "assignerShortName": "Bitdefender", "dateReserved": "2023-11-27T14:21:53.117Z", "datePublished": "2024-04-09T13:41:34.843Z", "dateUpdated": "2024-08-02T08:28:21.578Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WebOS", "vendor": "LG", "versions": [{"status": "affected", "version": " 4.9.7"}, {"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "6.3.3-442"}, {"status": "affected", "version": "7.3.1-43"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Alexandru Laz\u0103r of Bitdefender Labs"}], "datePublic": "2024-04-09T13:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. <br><br>Full versions and TV models affected:<br><br>webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA <br>webOS 5.5.0 - 04.50.51 running on OLED55CXPUA <br>webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  <br>webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA <br>"}], "value": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.\u00a0\n\nFull versions and TV models affected:\n\nwebOS 4.9.7 - 5.30.40 running on LG43UM7000PLA \nwebOS 5.5.0 - 04.50.51 running on OLED55CXPUA \nwebOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB \u00a0\nwebOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA \n"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender", "dateUpdated": "2024-04-18T07:34:37.533Z"}, "references": [{"url": "https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/"}, {"tags": ["vendor-advisory"], "url": "https://lgsecurity.lge.com/bulletins/tv#updateDetails"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An update to a newer firmware version fixes the issue."}], "value": "An update to a newer firmware version fixes the issue."}], "source": {"discovery": "EXTERNAL"}, "title": "PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T15:53:04.847156Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:37.217Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:28:21.578Z"}, "title": "CVE Program Container", "references": [{"url": "https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/", "tags": ["x_transferred"]}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lgsecurity.lge.com/bulletins/tv#updateDetails"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/", "tags": ["x_transferred"]}, {"url": "https://lgsecurity.lge.com/bulletins/tv#updateDetails", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:28:21.578Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-09T15:53:04.847156Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:43.316Z"}}], "cna": {"title": "PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alexandru Laz\u0103r of Bitdefender Labs"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "LG", "product": "WebOS", "versions": [{"status": "affected", "version": " 4.9.7"}, {"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "6.3.3-442"}, {"status": "affected", "version": "7.3.1-43"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "An update to a newer firmware version fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "An update to a newer firmware version fixes the issue.", "base64": false}]}], "datePublic": "2024-04-09T13:00:00.000Z", "references": [{"url": "https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/"}, {"url": "https://lgsecurity.lge.com/bulletins/tv#updateDetails", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.\u00a0\n\nFull versions and TV models affected:\n\nwebOS 4.9.7 - 5.30.40 running on LG43UM7000PLA \nwebOS 5.5.0 - 04.50.51 running on OLED55CXPUA \nwebOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB \u00a0\nwebOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA \n", "supportingMedia": [{"type": "text/html", "value": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. <br><br>Full versions and TV models affected:<br><br>webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA <br>webOS 5.5.0 - 04.50.51 running on OLED55CXPUA <br>webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  <br>webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA <br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender", "dateUpdated": "2024-04-18T07:34:37.533Z"}}}, "cveMetadata": {"cveId": "CVE-2023-6317", "state": "PUBLISHED", "dateUpdated": "2024-08-02T08:28:21.578Z", "dateReserved": "2023-11-27T14:21:53.117Z", "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "datePublished": "2024-04-09T13:41:34.843Z", "assignerShortName": "Bitdefender"}, "dataVersion": "5.1"}