2021-08-28 09:51:21 +00:00
id : CVE-2019-17503
info :
2023-01-30 21:35:42 +00:00
name : Kirona Dynamic Resource Scheduler - Information Disclosure
2021-08-28 09:51:21 +00:00
author : LogicalHunter
severity : medium
2023-02-02 23:05:19 +00:00
description : Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.
2023-09-06 12:53:28 +00:00
remediation : |
Apply the latest patch or update provided by the vendor to fix the information disclosure vulnerability.
2021-08-28 09:51:21 +00:00
reference :
- https://www.exploit-db.com/exploits/47498
2022-05-17 09:18:12 +00:00
- https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities
- http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
2023-01-30 21:35:42 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-17503
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 5.3
2021-09-10 11:26:40 +00:00
cve-id : CVE-2019-17503
cwe-id : CWE-425
2023-08-31 11:46:18 +00:00
epss-score : 0.00433
2023-11-05 22:23:39 +00:00
epss-percentile : 0.71803
2023-09-06 12:53:28 +00:00
cpe : cpe:2.3:a:kirona:dynamic_resource_scheduling:5.5.3.5:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : kirona
product : dynamic_resource_scheduling
tags : cve,cve2019,exposure,edb,packetstorm
2021-08-28 09:51:21 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-08-28 09:51:21 +00:00
- method : GET
path :
- "{{BaseURL}}/osm/REGISTER.cmd"
- "{{BaseURL}}/osm_tiles/REGISTER.cmd"
matchers-condition : and
matchers :
- type : word
part : body
words :
- "DEBUGMAPSCRIPT=TRUE"
2021-08-31 06:30:11 +00:00
- "@echo off"
condition : and
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
2023-11-06 06:48:30 +00:00
# digest: 4b0a0048304602210089489fc363cd470c8efcdff833262957e902f949d2b0b7596eb70edcb6958747022100cb5c09a412dc169528876265c49266722494f27e7680884192c5aea05c4fd550:922c64590222798bb761d5b6d8e72950