Lucene search

NCSC.chCVE-2023-3064

HistoryJun 05, 2023 - 9:15 a.m.

CVE-2023-3064

2023-06-0509:15:09

CWE-200

CWE-922

NCSC.ch

web.nvd.nist.gov

cve-2023-3064

user list access

vulnerability

mobatime amxgt100

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

55.0%

JSON

Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

Affected configurations

Nvd

Node

mobatimeamxgt_100Range≤1.3.20android

VendorProductVersionCPE
mobatimeamxgt_100*cpe:2.3:a:mobatime:amxgt_100:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
mobatime	amxgt_100	*	cpe:2.3:a:mobatime:amxgt_100::::::android::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "API"
    ],
    "packageName": "com.Mobatime.AMXGT100",
    "product": "Mobatime mobile application AMXGT100",
    "vendor": "Mobatime",
    "versions": [
      {
        "lessThanOrEqual": "1.3.20",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

55.0%

JSON

Related for CVE-2023-3064