Base Score

HIGH7.5

CVE-2019-16236

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

VectorNETWORK

Published Bycve@mitre.org

Published DateSep 11, 2019, 19:15

Weakness Type (CWE):CWE-862

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

HIGH

Availability (A)

NONE

References

http://www.openwall.com/lists/oss-security/2019/09/12/5
https://github.com/dino/dino/commit/dd33f5f949248d87d34f399e8846d5ee5b8823d9
https://gultsch.de/dino_multiple.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5TMGQ5Q6QMIFG4NVUWMOWW3GIPGWQZVF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZBNQAOBWTIOKNO4PIYNX624ACGUXSXQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YUBM7GDZBB6MZZALDWYRAPNV6HJNLNMC/
https://seclists.org/bugtraq/2019/Sep/31
https://usn.ubuntu.com/4306-1/
https://www.debian.org/security/2019/dsa-4524

Base Score

HIGH7.5

Weakness Type (CWE):CWE-862

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

HIGH

Availability (A)

NONE