CVE-2017-6910

EUVD-2017-15964

12.04.2018, 15:29

The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4.x before 4.4.2 hotfix-1, 4.5.x before 4.5.3 hotfix-1, and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 42%

Affected Products (NVD)

Vendor	Product	Version
kaazing	kaazing_gateway	𝑥 < 4.5.3
kaazing	kaazing_gateway	4.5.3
kaazing	kaazing_gateway	4.5.3:hotfix1
kaazing	kaazing_gateway	4.4.0 ≤ 𝑥 < 4.4.2
kaazing	kaazing_gateway	4.5.0 ≤ 𝑥 < 4.5.3
kaazing	kaazing_gateway	4.0.5
kaazing	kaazing_gateway	4.0.6
kaazing	kaazing_gateway	4.0.6:hotfix2
kaazing	kaazing_gateway	4.0.7
kaazing	kaazing_gateway	4.4.2:hotfix1
kaazing	kaazing_gateway	4.5.3:hotfix1
tenefit	kaazing_websocket_gateway	𝑥 < 5.6.0
tenefit	kaazing_websocket_gateway	𝑥 < 5.6.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

https://support.kaazing.com/hc/en-us/articles/115004752368