Details of VAR-201903-1228

ID

VAR-201903-1228

CVE

CVE-2018-4030

TITLE

CUJO Smart Firewall In HTTP Request smuggling vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-015144

DESCRIPTION

An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any malicious websites and bypass the firewall. An attacker could send an HTTP request to exploit this vulnerability. CUJO Smart Firewall is a home intelligent firewall device produced by CUJO Company in the United States

Trust: 1.71

sources: NVD: CVE-2018-4030 // JVNDB: JVNDB-2018-015144 // VULHUB: VHN-134061

AFFECTED PRODUCTS

vendor:	getcujo	model:	smart firewall	scope:	eq	version:	7003	Trust: 1.0
vendor:	cujo ai	model:	smart firewall	scope:	eq	version:	7003	Trust: 0.8

sources: JVNDB: JVNDB-2018-015144 // NVD: CVE-2018-4030

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-4030
value:	HIGH
Trust: 1.0
talos-cna@cisco.com:	CVE-2018-4030
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-4030
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201903-631
value:	HIGH
Trust: 0.6
VULHUB:	VHN-134061
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-4030
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-134061
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-4030
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
talos-cna@cisco.com:	CVE-2018-4030
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 1.0
NVD:	CVE-2018-4030
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-134061 // JVNDB: JVNDB-2018-015144 // CNNVD: CNNVD-201903-631 // NVD: CVE-2018-4030 // NVD: CVE-2018-4030

PROBLEMTYPE DATA

problemtype:

CWE-444

Trust: 1.9

sources: VULHUB: VHN-134061 // JVNDB: JVNDB-2018-015144 // NVD: CVE-2018-4030

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201903-631

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201903-631

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-015144

PATCH

title:

Top Page

url:

https://www.getcujo.com/

Trust: 0.8

sources: JVNDB: JVNDB-2018-015144

EXTERNAL IDS

db:	TALOS	id:	TALOS-2018-0702	Trust: 2.5
db:	NVD	id:	CVE-2018-4030	Trust: 2.5
db:	JVNDB	id:	JVNDB-2018-015144	Trust: 0.8
db:	CNNVD	id:	CNNVD-201903-631	Trust: 0.7
db:	NSFOCUS	id:	43010	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.0958	Trust: 0.6
db:	VULHUB	id:	VHN-134061	Trust: 0.1

sources: VULHUB: VHN-134061 // JVNDB: JVNDB-2018-015144 // CNNVD: CNNVD-201903-631 // NVD: CVE-2018-4030

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2018-0702	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2018-4030	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4030	Trust: 0.8
url:	http://www.ibm.com/support/docview.wss	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/43010	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/77666	Trust: 0.6
url:	https://www.talosintelligence.com/vulnerability_reports/talos-2018-0702	Trust: 0.6

sources: VULHUB: VHN-134061 // JVNDB: JVNDB-2018-015144 // CNNVD: CNNVD-201903-631 // NVD: CVE-2018-4030

CREDITS

Claudio Bozzato ,Discovered by Claudio Bozzato of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-201903-631

SOURCES

db:	VULHUB	id:	VHN-134061
db:	JVNDB	id:	JVNDB-2018-015144
db:	CNNVD	id:	CNNVD-201903-631
db:	NVD	id:	CVE-2018-4030

LAST UPDATE DATE

2024-11-23T19:38:28.087000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-134061	date:	2019-04-01T00:00:00
db:	JVNDB	id:	JVNDB-2018-015144	date:	2019-05-07T00:00:00
db:	CNNVD	id:	CNNVD-201903-631	date:	2022-07-06T00:00:00
db:	NVD	id:	CVE-2018-4030	date:	2024-11-21T04:06:33.483

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-134061	date:	2019-03-21T00:00:00
db:	JVNDB	id:	JVNDB-2018-015144	date:	2019-05-07T00:00:00
db:	CNNVD	id:	CNNVD-201903-631	date:	2019-03-19T00:00:00
db:	NVD	id:	CVE-2018-4030	date:	2019-03-21T16:29:01.767