CVE-2018-6976

The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/105367	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041604	Third Party Advisory VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0023.html	Vendor Advisory
http://www.securityfocus.com/bid/105367	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041604	Third Party Advisory VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0023.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vmware:workspace_one:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2018-09-11 14:29

Updated : 2024-11-21 04:11

NVD link : CVE-2018-6976

Mitre link : CVE-2018-6976

CVE.ORG link : CVE-2018-6976

JSON object : View

Products Affected

vmware

workspace_one

CWE

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2018-6976", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-09-11T14:29:02.987", "references": [{"url": "http://www.securityfocus.com/bid/105367", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@vmware.com"}, {"url": "http://www.securitytracker.com/id/1041604", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@vmware.com"}, {"url": "https://www.vmware.com/security/advisories/VMSA-2018-0023.html", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "http://www.securityfocus.com/bid/105367", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1041604", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vmware.com/security/advisories/VMSA-2018-0023.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker."}, {"lang": "es", "value": "VMware Content Locker para iOS en versiones anteriores a la 4.14 contienen una vulnerabilidad de protecci\u00f3n de datos en la base de datos de SQLite. Esta vulnerabilidad est\u00e1 relacionado con nombres de archivo sin cifrar y metadatos asociados en la base de datos de SQLite para el Content Locker."}], "lastModified": "2024-11-21T04:11:31.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:workspace_one:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "D3B79362-1E26-4D7C-96A5-52F83069C83A", "versionEndExcluding": "4.14"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}