Improper Authentication

2023-12-1514:07:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

improper authentication

bluez

hid messages

user interaction

access control

injection vulnerability

central role

malicious message

6.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.5%

JSON

bluez is vulnerable to Improper authentication. The vulnerability due to permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. It leads to allow an attacker get access to inject a malicious message.

CPENameOperatorVersion
bluez:bustereq5.50-1.2~deb10u1
bluez:bustereq5.50-1.2~deb10u2
bluez:sideq5.55-1
bluez:bullseyeeq5.55-1
bluez:bustereq5.50-1.2~deb10u1
bluez:bustereq5.50-1.2~deb10u2
bluez:sideq5.55-1
bluez:bullseyeeq5.55-1

Name	Operator	Version
bluez:buster	eq	5.50-1.2~deb10u1
bluez:buster	eq	5.50-1.2~deb10u2
bluez:sid	eq	5.55-1
bluez:bullseye	eq	5.55-1
bluez:buster	eq	5.50-1.2~deb10u1
bluez:buster	eq	5.50-1.2~deb10u2
bluez:sid	eq	5.55-1
bluez:bullseye	eq	5.55-1