Lucene search

[email protected]CVE-2023-6913

HistoryDec 19, 2023 - 3:15 p.m.

CVE-2023-6913

2023-12-1915:15:09

CWE-384

[email protected]

web.nvd.nist.gov

session hijacking

vulnerability

imou life

version 6.7.0

qr code

phishing attacks

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.

Affected configurations

Vulners

NVD

Node

imouimou_life_appRange≤6.7.0

CPENameOperatorVersion
imoulife:imou_lifeimoulife imou lifeeq6.7.0

CPE	Name	Operator	Version
imoulife:imou_life	imoulife imou life	eq	6.7.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Imou Life app",
    "vendor": "Imou",
    "versions": [
      {
        "status": "affected",
        "version": "6.7.0"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2023-6913

cvelist1 prion1 nvd1