Design/Logic Flaw

2017-06-3012:29:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.

CPENameOperatorVersion
osci_transport_libraryeq1.6.1
osci_transport_libraryeq1.6

CPE	Name	Operator	Version
	osci_transport_library	eq	1.6.1
	osci_transport_library	eq	1.6

References

blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html

seclists.org/fulldisclosure/2017/Jun/44