Auth bypass in Stashcat Heinekingmedia
CVE-2017-11135
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be interpreted as a vulnerability in customer-controlled software, in the sense that the StashCat client side has no secure way to signal that it is ending a session and that data should be deleted.
Vulnerability class: Broken Access Control
EPSS: 0.011 (61.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Stashcat Heinekingmedia
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-11135?
- CVE-2017-11135 is a high-severity vulnerability in Stashcat Heinekingmedia, classified under Missing Authorization. CVSS score: 7.5/10. Published 2017-08-01.
- How severe is CVE-2017-11135?
- High severity. CVSS v3 base score is 7.5 out of 10.