{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-28T15:08:20", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-44124", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal", "refsource": "MISC", "url": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal"}, {"name": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626", "refsource": "MISC", "url": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:17:23.474Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-44124", "datePublished": "2022-03-28T15:08:21", "dateReserved": "2021-11-22T00:00:00", "dateUpdated": "2024-08-04T04:17:23.474Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:hiby:r3_pro_firmware:1.5:*:*:*:*:*:*:*", "matchCriteriaId": "360F76DC-ADEC-4874-9193-9637512451AA", "vulnerable": true}, {"criteria": "cpe:2.3:o:hiby:r3_pro_firmware:1.6:*:*:*:*:*:*:*", "matchCriteriaId": "55858C47-5A39-4578-A977-3825DABF1A39", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:hiby:r3_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8654EDB-EDC3-4185-8844-076139DD5260", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP."}, {"lang": "es", "value": "Hiby Music Hiby OS R3 Pro versiones 1.5 y 1.6, es vulnerable a un Salto de Directorio. El servidor HTTP no presenta suficiente saneo de datos de entrada cuando son mostrados datos de la tarjeta SD, un atacante puede navegar mediante el sistema de archivos del dispositivo a trav\u00e9s de HTTP"}], "id": "CVE-2021-44124", "lastModified": "2024-11-21T06:30:24.353", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-28T16:15:08.240", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}