Starry Station Webserver Access-Control-Allow-Origin privilege escalation

A vulnerability, which was classified as critical, has been found in Starry Station (affected version not known). Affected by this issue is an unknown part of the component Webserver. The manipulation of the argument Access-Control-Allow-Origin as part of a Header leads to a privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-269. Impacted is confidentiality, integrity, and availability.

The weakness was shared 06/11/2019 as mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. This vulnerability is handled as CVE-2017-13717 since 08/28/2017. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/11/2019).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry 136245 is related to this item.

Vendor

Name

VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.5

VulDB Base Score: ≈5.5
VulDB Temp Score: ≈5.5
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation (CWE-269)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: no mitigation known

0-Day Time: 🔒

08/28/2017 CVE assigned
06/11/2019 +652 days Advisory disclosed
06/11/2019 +0 days VulDB entry created
06/11/2019 +0 days VulDB last updateAdvisory: seclists.org

CVE: CVE-2017-13717 (🔒)
See also: 🔒

Created: 06/11/2019 06:56 AM
Complete: 🔍

Comments are closed.