Lucene search

[email protected]CVE-2019-1020010

HistoryJul 29, 2019 - 1:15 p.m.

CVE-2019-1020010

2019-07-2913:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2019-1020010

misskey

security vulnerability

user token hijacking

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

43.2%

JSON

Misskey before 10.102.4 allows hijacking a user’s token.

Affected configurations

NVD

Node

misskeymisskeyRange10.46.0–10.102.4

misskeymisskeyRange11.0.0–11.20.2

misskeymisskeyMatch11.0.0alpha1

misskeymisskeyMatch11.0.0alpha10

misskeymisskeyMatch11.0.0alpha2

misskeymisskeyMatch11.0.0alpha3

misskeymisskeyMatch11.0.0alpha4

misskeymisskeyMatch11.0.0alpha5

misskeymisskeyMatch11.0.0alpha6

misskeymisskeyMatch11.0.0alpha7

misskeymisskeyMatch11.0.0alpha8

misskeymisskeyMatch11.0.0beta1

misskeymisskeyMatch11.0.0beta10

misskeymisskeyMatch11.0.0beta11

misskeymisskeyMatch11.0.0beta12

misskeymisskeyMatch11.0.0beta13

misskeymisskeyMatch11.0.0beta14

misskeymisskeyMatch11.0.0beta15

misskeymisskeyMatch11.0.0beta16

misskeymisskeyMatch11.0.0beta2

misskeymisskeyMatch11.0.0beta3

misskeymisskeyMatch11.0.0beta4

misskeymisskeyMatch11.0.0beta5

misskeymisskeyMatch11.0.0beta6

misskeymisskeyMatch11.0.0beta7

misskeymisskeyMatch11.0.0beta8

misskeymisskeyMatch11.0.0beta9

CPENameOperatorVersion
misskey:misskeymisskeylt10.102.4
misskey:misskeymisskeylt11.20.2
misskey:misskeymisskeyeq11.0.0

CPE	Name	Operator	Version
misskey:misskey	misskey	lt	10.102.4
misskey:misskey	misskey	lt	11.20.2
misskey:misskey	misskey	eq	11.0.0

CNA Affected

[
  {
    "product": "Misskey",
    "vendor": "Misskey",
    "versions": [
      {
        "status": "affected",
        "version": "< 10.102.4"
      }
    ]
  }
]

References

github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

43.2%

JSON

Related for CVE-2019-1020010

cvelist1 nvd1 prion1 osv1