CVEvulnerability
CVE-2019-10886
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-04-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-306
Description
An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network.
Affected configurations
• sony photo sharing plus (< pkg6.5629)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/32 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108072 Third Party Advisory, VDB Entry
- https://seclists.org/bugtraq/2019/Apr/34 Exploit, Mailing List, Third Party Advisory
- https://www.sony.com/electronics/support/downloads/00016043 Exploit, Vendor Advisory
- http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/32 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108072 Third Party Advisory, VDB Entry
- https://seclists.org/bugtraq/2019/Apr/34 Exploit, Mailing List, Third Party Advisory
- https://www.sony.com/electronics/support/downloads/00016043 Exploit, Vendor Advisory