Lucene search

ZteCVE-2020-6865

HistoryApr 30, 2020 - 10:15 p.m.

CVE-2020-6865

2020-04-3022:15:12

CWE-200

zte

web.nvd.nist.gov

cve-2020-6865

zte

sdn controller

information leakage

vulnerability

oscp

version 16.19.10

version 16.19.20

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program’s failure to optimize the response of failure to the request, the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20.

Affected configurations

Nvd

Node

zteoscpMatch16.19.10

zteoscpMatch16.19.20

VendorProductVersionCPE
zteoscp16.19.10cpe:2.3:a:zte:oscp:16.19.10:*:*:*:*:*:*:*
zteoscp16.19.20cpe:2.3:a:zte:oscp:16.19.20:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zte	oscp	16.19.10	cpe:2.3:a:zte:oscp:16.19.10:::::::*
zte	oscp	16.19.20	cpe:2.3:a:zte:oscp:16.19.20:::::::*

CNA Affected

[
  {
    "product": "OSCP",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V16.19.10"
      },
      {
        "status": "affected",
        "version": "V16.19.20"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012782

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for CVE-2020-6865