MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source ident…
高危 CVSS 8.2
摘要
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://github.com/themoos/core-moos Product
- https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp#L748 Issue Tracking
- https://github.com/themoos/core-moos/commit/26308f0e393f0e80bfa09b275891e776b8dbf522 Issue Tracking
- https://github.com/themoos/core-moos/pull/76 Issue Tracking
- https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-message-source-spoofing-via-wire-identity Third Party Advisory
时间线
- nvd_ingest NVD