CVE-2019-25031

Katalog CVE

CVSS 5.9 · Medium EPSS 1,7%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada nlnetlabs unbound, debian linux. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation

Rincian

Terbit di NVD

27 April 2021

Terakhir diubah

25 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html mailing list · advisory pihak ketiga
• https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ not applicable · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210507-0007/ advisory pihak ketiga