5.9

CVE-2019-10886

Exploit
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sony ≫ Photo Sharing Plus Version < pkg6.5629
   Sony ≫ Kdl-50w800c Version-
   Sony ≫ Kdl-50w805c Version-
   Sony ≫ Kdl-50w807c Version-
   Sony ≫ Kdl-50w809c Version-
   Sony ≫ Kdl-50w820c Version-
   Sony ≫ Kdl-55w800c Version-
   Sony ≫ Kdl-55w805c Version-
   Sony ≫ Kdl-65w850c Version-
   Sony ≫ Kdl-65w855c Version-
   Sony ≫ Kdl-65w857c Version-
   Sony ≫ Kdl-75w850c Version-
   Sony ≫ Kdl-75w855c Version-
   Sony ≫ X7500d Version-
   Sony ≫ Xbr-100z9d Version-
   Sony ≫ Xbr-43x800d Version-
   Sony ≫ Xbr-43x800e Version-
   Sony ≫ Xbr-43x830c Version-
   Sony ≫ Xbr-49x700d Version-
   Sony ≫ Xbr-49x800c Version-
   Sony ≫ Xbr-49x800d Version-
   Sony ≫ Xbr-49x800e Version-
   Sony ≫ Xbr-49x830c Version-
   Sony ≫ Xbr-49x835c Version-
   Sony ≫ Xbr-49x835d Version-
   Sony ≫ Xbr-49x837c Version-
   Sony ≫ Xbr-49x839c Version-
   Sony ≫ Xbr-49x900e Version-
   Sony ≫ Xbr-55a1e Version-
   Sony ≫ Xbr-55x700d Version-
   Sony ≫ Xbr-55x800e Version-
   Sony ≫ Xbr-55x805c Version-
   Sony ≫ Xbr-55x806e Version-
   Sony ≫ Xbr-55x807c Version-
   Sony ≫ Xbr-55x809c Version-
   Sony ≫ Xbr-55x810c Version-
   Sony ≫ Xbr-55x850c Version-
   Sony ≫ Xbr-55x850d Version-
   Sony ≫ Xbr-55x855c Version-
   Sony ≫ Xbr-55x855d Version-
   Sony ≫ Xbr-55x857c Version-
   Sony ≫ Xbr-55x857d Version-
   Sony ≫ Xbr-55x900c Version-
   Sony ≫ Xbr-55x900e Version-
   Sony ≫ Xbr-55x905c Version-
   Sony ≫ Xbr-55x907c Version-
   Sony ≫ Xbr-55x930d Version-
   Sony ≫ Xbr-55x930e Version-
   Sony ≫ Xbr-65a1e Version-
   Sony ≫ Xbr-65x750d Version-
   Sony ≫ Xbr-65x800c Version-
   Sony ≫ Xbr-65x805c Version-
   Sony ≫ Xbr-65x807c Version-
   Sony ≫ Xbr-65x809c Version-
   Sony ≫ Xbr-65x810c Version-
   Sony ≫ Xbr-65x850c Version-
   Sony ≫ Xbr-65x850d Version-
   Sony ≫ Xbr-65x850e Version-
   Sony ≫ Xbr-65x855c Version-
   Sony ≫ Xbr-65x855d Version-
   Sony ≫ Xbr-65x857c Version-
   Sony ≫ Xbr-65x857d Version-
   Sony ≫ Xbr-65x900c Version-
   Sony ≫ Xbr-65x900e Version-
   Sony ≫ Xbr-65x905c Version-
   Sony ≫ Xbr-65x907c Version-
   Sony ≫ Xbr-65x930c Version-
   Sony ≫ Xbr-65x930d Version-
   Sony ≫ Xbr-65x930e Version-
   Sony ≫ Xbr-65x935d Version-
   Sony ≫ Xbr-65x937d Version-
   Sony ≫ Xbr-65z9d Version-
   Sony ≫ Xbr-75x850c Version-
   Sony ≫ Xbr-75x850d Version-
   Sony ≫ Xbr-75x850e Version-
   Sony ≫ Xbr-75x855c Version-
   Sony ≫ Xbr-75x855d Version-
   Sony ≫ Xbr-75x857d Version-
   Sony ≫ Xbr-75x900e Version-
   Sony ≫ Xbr-75x910c Version-
   Sony ≫ Xbr-75x940c Version-
   Sony ≫ Xbr-75x940d Version-
   Sony ≫ Xbr-75x940e Version-
   Sony ≫ Xbr-75x945c Version-
   Sony ≫ Xbr-75z9d Version-
   Sony ≫ Xbr-77a1e Version-
   Sony ≫ Xbr-85x850d Version-
   Sony ≫ Xbr-85x855d Version-
   Sony ≫ Xbr-85x857d Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.77% 0.727
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

http://seclists.org/fulldisclosure/2019/Apr/32
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/108072
Third Party Advisory
VDB Entry
https://seclists.org/bugtraq/2019/Apr/34
Third Party Advisory
Exploit
Mailing List