Lucene search

MitreCVE-2019-19735

HistoryDec 30, 2019 - 5:15 p.m.

CVE-2019-19735

2019-12-3017:15:20

CWE-916

mitre

web.nvd.nist.gov

cve-2019-19735

yetishare

password reset

brute force

security vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.

Affected configurations

Nvd

Node

mfscriptsyetishareRange3.5.2–4.5.3

VendorProductVersionCPE
mfscriptsyetishare*cpe:2.3:a:mfscripts:yetishare:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mfscripts	yetishare	*	cpe:2.3:a:mfscripts:yetishare::::::::

References

github.com/jra89/CVE-2019-19735

medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

Related for CVE-2019-19735