Lucene search

[email protected]CVE-2016-2296

HistoryMay 14, 2016 - 4:59 p.m.

CVE-2016-2296

2016-05-1416:59:02

CWE-254

[email protected]

web.nvd.nist.gov

cve-2016-2296

metcontrol

authentication bypass

remote attackers

sensitive information

data modification

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

9 High

AI Score

Confidence

High

0.39 Low

EPSS

Percentile

97.3%

JSON

Meteocontrol WEB’log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for “post-admin” login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.

Affected configurations

NVD

Node

meteocontrolweb\'log_basic_100Match-

meteocontrolweb\'log_lightMatch-

meteocontrolweb\'log_proMatch-

meteocontrolweb\'log_pro_unlimitedMatch-

CPENameOperatorVersion
meteocontrol:web\'log_basic_100meteocontrol web'log basic 100eq-
meteocontrol:web\'log_lightmeteocontrol web'log lighteq-
meteocontrol:web\'log_prometeocontrol web'log proeq-
meteocontrol:web\'log_pro_unlimitedmeteocontrol web'log pro unlimitedeq-

CPE	Name	Operator	Version
meteocontrol:web\'log_basic_100	meteocontrol web'log basic 100	eq	-
meteocontrol:web\'log_light	meteocontrol web'log light	eq	-
meteocontrol:web\'log_pro	meteocontrol web'log pro	eq	-
meteocontrol:web\'log_pro_unlimited	meteocontrol web'log pro unlimited	eq	-