Id:
CVE-2018-19443
Comment
:
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
CVSSv2 Score:
4.3
Access vector:
|
NETWORK
|
Access complexity:
|
MEDIUM
|
Authentication:
|
NONE
|
Confidentiality impact:
|
PARTIAL
|
Integrity impact:
|
NONE
|
Availability impact:
|
NONE
|
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3 Score:
5.9
Attack vector:
|
NETWORK
|
Attack complexity:
|
HIGH
|
Privileges required:
|
NONE
|
User interaction:
|
NONE
|
Scope:
|
UNCHANGED
|
Confidentiality impact:
|
HIGH
|
Integrity impact:
|
NONE
|
Availability impact:
|
NONE
|
CVSSv3 Vector:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References: