CVE-2019-8282
07.06.2019, 15:29
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gemalto | sentinel_ldk | 𝑥 < 7.92 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-300 - Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
- CWE-346 - Origin Validation ErrorThe software does not properly verify that the source of data or communication is valid.
References