Lucene search

[email protected]CVE-2023-33983

HistoryMay 24, 2023 - 6:15 p.m.

CVE-2023-33983

2023-05-2418:15:10

CWE-862

[email protected]

web.nvd.nist.gov

cve-2023-33983

briar

introduction client

out-of-band verification

man-in-the-middle attack

nvd

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

33.4%

JSON

The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties.

CPENameOperatorVersion
briarproject:briarbriarproject briarle1.5.3
briarproject:briarbriarproject briareq1.4.11
briarproject:briarbriarproject briareq1.2.4
briarproject:briarbriarproject briareq1.2.8
briarproject:briarbriarproject briareq1.2.18
briarproject:briarbriarproject briareq1.2.19
briarproject:briarbriarproject briareq1.4.9
briarproject:briarbriarproject briareq1.4.10
briarproject:briarbriarproject briareq1.4.23
briarproject:briarbriarproject briareq1.2.9

CPE	Name	Operator	Version
briarproject:briar	briarproject briar	le	1.5.3
briarproject:briar	briarproject briar	eq	1.4.11
briarproject:briar	briarproject briar	eq	1.2.4
briarproject:briar	briarproject briar	eq	1.2.8
briarproject:briar	briarproject briar	eq	1.2.18
briarproject:briar	briarproject briar	eq	1.2.19
briarproject:briar	briarproject briar	eq	1.4.9
briarproject:briar	briarproject briar	eq	1.4.10
briarproject:briar	briarproject briar	eq	1.4.23
briarproject:briar	briarproject briar	eq	1.2.9

Rows per page:

1-10 of 721

References

ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

33.4%

JSON

Related for CVE-2023-33983

prion1