« Volver al listado

CVE-2018-9031

Estado: ModificadaCrítica (9.8)—

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tnlsoftsolutions — Sentry Vision

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-9031",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-29T16:29:00.207",
  "references": [
    {
      "url": "https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.youtube.com/watch?v=pLMH9vGPRCo",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.youtube.com/watch?v=pLMH9vGPRCo",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an \"if(pwd ==\" line in the HTML source code. This means, in effect, that authentication occurs only on the client side."
    },
    {
      "lang": "es",
      "value": "La interfaz de inicio de sesión en los dispositivos TNLSoftSolutions Sentry Vision 3.x revela la contraseña al leer una línea \"if(pwd ==\" en el código fuente HTML. Esto significa que la autenticación, efectivamente, ocurre solo en el lado del cliente."
    }
  ],
  "lastModified": "2026-06-17T02:05:56.903",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tnlsoftsolutions:sentry_vision:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4F3A5E3-6F02-45F0-AD8E-51B78AEB4BD4"
            },
            {
              "criteria": "cpe:2.3:a:tnlsoftsolutions:sentry_vision:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AF4492E-2146-46BB-AA3A-53AA45F6BBC4"
            },
            {
              "criteria": "cpe:2.3:a:tnlsoftsolutions:sentry_vision:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92351066-008F-4A60-BE22-3846CE4ABEDF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}