Lucene search

MitreCVE-2019-20329

HistoryJan 03, 2020 - 12:15 a.m.

CVE-2019-20329

2020-01-0300:15:11

CWE-346

mitre

web.nvd.nist.gov

cve-2019-20329

openlambda

dns rebinding

vulnerability

nvd

rest api

tcp port 5000

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.

Affected configurations

Nvd

Node

openlambda_projectopenlambdaMatch2019-09-10

VendorProductVersionCPE
openlambda_projectopenlambda2019-09-10cpe:2.3:a:openlambda_project:openlambda:2019-09-10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openlambda_project	openlambda	2019-09-10	cpe:2.3:a:openlambda_project:openlambda:2019-09-10:::::::*

References

github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/common/config.go#L135

github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/server/lambdaServer.go#L92-L97

github.com/open-lambda/open-lambda/issues/92

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

Related for CVE-2019-20329