CVE-2019-12395 : In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can

In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.

Published 2019-05-28 13:29:00

Updated 2021-11-08 19:47:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2019-12395

Dynmap Project » Dynmap
Versions before (<) 3.0
cpe:2.3:a:dynmap_project:dynmap:*:*:*:*:*:*:*:*
Matching versions
Dynmap Project » Dynmap » Version: 3.0 Update Alpha1
cpe:2.3:a:dynmap_project:dynmap:3.0:alpha1:*:*:*:*:*:*
Matching versions
Dynmap Project » Dynmap » Version: 3.0 Update Alpha2
cpe:2.3:a:dynmap_project:dynmap:3.0:alpha2:*:*:*:*:*:*
Matching versions
Dynmap Project » Dynmap » Version: 3.0 Update Alpha3
cpe:2.3:a:dynmap_project:dynmap:3.0:alpha3:*:*:*:*:*:*
Matching versions
Dynmap Project » Dynmap » Version: 3.0 Update RC3
cpe:2.3:a:dynmap_project:dynmap:3.0:rc3:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-12395

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-12395

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2019-12395

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12395

https://github.com/webbukkit/dynmap/pull/2475

Fix required login bypass vulnerability by Ry0taK · Pull Request #2475 · webbukkit/dynmap · GitHub
Patch;Third Party Advisory
https://github.com/webbukkit/dynmap/issues/2474

Required login bypass vulnerability · Issue #2474 · webbukkit/dynmap · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://github.com/webbukkit/dynmap/commit/641f142cd3ccdcbfb04eda3059be22dd9ed93783

Merge pull request #2475 from Ry0taK/v3.0 · webbukkit/dynmap@641f142 · GitHub
Patch;Third Party Advisory
http://jvn.jp/en/jp/JVN89046645/index.html

JVN#89046645: A map plugin for Minecraft server "Dynmap" fails to restrict access permissions
Third Party Advisory

Jump to

Vulnerability Details : CVE-2019-12395

Products affected by CVE-2019-12395

Exploit prediction scoring system (EPSS) score for CVE-2019-12395

CVSS scores for CVE-2019-12395

CWE ids for CVE-2019-12395

References for CVE-2019-12395