Lucene search

[email protected]CVE-2022-24190

HistoryNov 28, 2022 - 10:15 p.m.

CVE-2022-24190

2022-11-2822:15:10

CWE-306

CWE-862

[email protected]

web.nvd.nist.gov

cve-2022-24190

ourphoto app

authentication bypass

authorization bypass

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to accept their own bind request, without the end-users approval or interaction.

Affected configurations

NVD

Node

sz-fujiaourphotoMatch1.4.1

CPENameOperatorVersion
sz-fujia:ourphotosz-fujia ourphotoeq1.4.1

CPE	Name	Operator	Version
sz-fujia:ourphoto	sz-fujia ourphoto	eq	1.4.1

References

www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON

Related for CVE-2022-24190

cvelist1 nvd1 prion1