CVE-2019-6481 (GCVE-0-2019-6481)

Vulnerability from cvelistv5 – Published: 2019-03-29 13:22 – Updated: 2024-08-04 20:23
VLAI
Summary
Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach, related to a "Multifactor Auth Bypass, Full Disk Encryption Bypass" issue affecting the Affected Chrome Plugin component.
Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • n/a
Assigner
References
Date Public
2019-03-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:23:20.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://redcoded.com/cve/2018/03/10/CVE.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://redcoded.com/cve/2019/03/18/CVE.html"
          },
          {
            "name": "20190319 2FA \u0026 macOS Disk Encryption Bypass in Abine Blur 7.24* [CVE-2019-6481]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Mar/33"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Abine Blur 7.8.2431 allows remote attackers to conduct \"Second-Factor Auth Bypass\" attacks by using the \"Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app.\" approach, related to a \"Multifactor Auth Bypass, Full Disk Encryption Bypass\" issue affecting the Affected Chrome Plugin component."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-29T13:24:26.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://redcoded.com/cve/2018/03/10/CVE.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://redcoded.com/cve/2019/03/18/CVE.html"
        },
        {
          "name": "20190319 2FA \u0026 macOS Disk Encryption Bypass in Abine Blur 7.24* [CVE-2019-6481]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Mar/33"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-6481",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Abine Blur 7.8.2431 allows remote attackers to conduct \"Second-Factor Auth Bypass\" attacks by using the \"Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app.\" approach, related to a \"Multifactor Auth Bypass, Full Disk Encryption Bypass\" issue affecting the Affected Chrome Plugin component."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://redcoded.com/cve/2018/03/10/CVE.html",
              "refsource": "MISC",
              "url": "https://redcoded.com/cve/2018/03/10/CVE.html"
            },
            {
              "name": "https://redcoded.com/cve/2019/03/18/CVE.html",
              "refsource": "MISC",
              "url": "https://redcoded.com/cve/2019/03/18/CVE.html"
            },
            {
              "name": "20190319 2FA \u0026 macOS Disk Encryption Bypass in Abine Blur 7.24* [CVE-2019-6481]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Mar/33"
            },
            {
              "name": "http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-6481",
    "datePublished": "2019-03-29T13:22:06.000Z",
    "dateReserved": "2019-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:23:20.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-6481",
      "date": "2026-06-05",
      "epss": "0.00677",
      "percentile": "0.71945"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-6481\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-03-29T14:29:00.640\",\"lastModified\":\"2024-11-21T04:46:31.763\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Abine Blur 7.8.2431 allows remote attackers to conduct \\\"Second-Factor Auth Bypass\\\" attacks by using the \\\"Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app.\\\" approach, related to a \\\"Multifactor Auth Bypass, Full Disk Encryption Bypass\\\" issue affecting the Affected Chrome Plugin component.\"},{\"lang\":\"es\",\"value\":\"Abine Blur, en su versi\u00f3n 7.8.2431, permite a los atacantes remotos realizar ataques de \\\"omisi\u00f3n de autenticaci\u00f3n de doble factor\\\" mediante el uso de la operaci\u00f3n \\\"Ejecute una operaci\u00f3n de clic derecho para acceder a un men\u00fa dev olvidado para insertar contrase\u00f1as del usuario que, de lo contrario, requerir\u00edan que este aceptase una petici\u00f3n de doble factor en una aplicaci\u00f3n m\u00f3vil\\\". Este enfoque est\u00e1 relacionado con un fallo de \\\"omisi\u00f3n de autenticaci\u00f3n multifactor, omisi\u00f3n de cifrado de disco entero\\\" que implica el componente del plugin de Chrome afectado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:abine:blur:7.8.2431:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F50DF56E-D17D-4934-9E92-14CC0A1F9B4E\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2019/Mar/33\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://redcoded.com/cve/2018/03/10/CVE.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://redcoded.com/cve/2019/03/18/CVE.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2019/Mar/33\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://redcoded.com/cve/2018/03/10/CVE.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://redcoded.com/cve/2019/03/18/CVE.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.