CVE-2019-18850 - TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY"

Back Back to CVE browser

HIGH

TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY"

Published Dec 4, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.18%

Description

TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY".

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-203

CWE-330

Insufficient Randomness

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8548
Advisory
https://github.com/trustedsec/trevorc2/blob/master/CHANGELOG.txt
x_refsource_MISCThird Party Advisory
https://github.com/trustedsec/trevorc2/issues/18
x_refsource_MISCIssue TrackingThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8548		Advisory
https://github.com/trustedsec/trevorc2/blob/master/CHANGELOG.txt		x_refsource_MISCThird Party Advisory
https://github.com/trustedsec/trevorc2/issues/18		x_refsource_MISCIssue TrackingThird Party Advisory