CVE-2023-3705

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

T

he vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.

References

Link	Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239	Patch Third Party Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3104_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3104:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3108_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3108:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3208_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3208:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:17

Type	Values Removed	Values Added
References	~~() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239 - Patch, Third Party Advisory~~	() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239 - Patch, Third Party Advisory

02 Oct 2024, 21:35

Type	Values Removed	Values Added
CWE		CWE-20

Information

Published : 2023-08-24 08:15

Updated : 2024-11-21 08:17

NVD link : CVE-2023-3705

Mitre link : CVE-2023-3705

CVE.ORG link : CVE-2023-3705

JSON object : View

Products Affected

cpplusworld

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2023-3705", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-24T08:15:09.040", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239", "tags": ["Patch", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.\n"}], "lastModified": "2024-11-21T08:17:53.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3104_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16BACB34-6325-4E52-A575-AEEDA3B2FE4F", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3104:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D1E31775-FFB5-40C3-9841-0C67D42E87C4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3108_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1A6A2F4-6595-4DFC-A926-A2CB677E0CCD", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3108:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "34F3AD8B-71BA-434A-A2EB-39C3292D4EC6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3208_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "872BD1A6-87C4-4AC4-93E9-2CE82E0D4B74", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3208:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8269EEF4-930E-4205-A1AF-3D1D7114A6B5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}