PT-2019-12078 · Sony · Sony Photo Sharing Plus

Publicado 2019-04-19 · Atualizado 2020-08-24 · CVE-2019-10886

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sony Photo Sharing Plus application in the firmware before PKG6.5629 version

Description The issue is related to incorrect access control in the Sony Photo Sharing Plus application. This allows an attacker to read arbitrary files without authentication over HTTP when the application is running, potentially enabling them to browse specific directories, such as images, inside a private network.

Recommendations For versions before PKG6.5629, update the firmware to version PKG6.5629 or later to resolve the issue. As a temporary workaround, consider disabling the Photo Sharing Plus application until the update is applied. Restrict access to the application to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-10886

Produtos afetados

Sony Photo Sharing Plus

Referências · 8

• 🔥 https://seclists.org/bugtraq/2019/Apr/34 · Exploit
• 🔥 https://sony.com/electronics/support/downloads/00016043 · Exploit
• http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html · Nota
• https://t.me/cybersecuritytechnologies/223 · Publicação no Telegram
• http://securityfocus.com/bid/108072 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10886 · Nota de Segurança
• http://seclists.org/fulldisclosure/2019/Apr/32 · Nota
• https://osv.dev/vulnerability/CVE-2019-10886 · Aviso do Fabricante