Critical severity · published Dec 28, 2018
CVE-2018-1000627
Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API key file
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API key file. An attacker could exploit this vulnerability to obtain the current API key to gain unauthorized access to the system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VH
V2i Hub · Battelle
2.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000627
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/147304
More from V2i Hub
9.8
CVE-2018-1000631
Battelle V2I Hub 3.0 is vulnerable to SQL injection
9.8
CVE-2018-1000628
Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET…
9.8
CVE-2018-1000626
Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the lack of requirement to change the default API key
9.8
CVE-2018-1000625
Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account
7.5
CVE-2018-1000624
Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality