Intel 471 Vulnerability Reports CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Intel 471 Vulnerability Reports

GET https://api.intel471.com/v1/cve/reports

Sample Response:

{
   "cveReportsTotalCount":1,
   "cveReports":[
      {
         "data":{
            "cve_report":{
               "risk_level":"high",
               "name":"CVE-2018-20250",
               "activity_location":{
                  "location_opensource":true,
                  "location_underground":true
               },
               "vendor_name":"RARLab",
               "exploit_status":{
                  "available":true,
                  "productized":true
               },
               "titan_links":[
                  {
                     "title":"WinRAR CVE-2018-20250 Exploit | Spread FAST",
                     "url":"https://titan.intel471.com/post_thread/4c30f13ded0db96f789f2eeaf3d45020?post_uid=6a29bf81f82bda975124aeb32a7074ba"
                  },
                  {
                     "title":"WINRAR EXPLOIT!! CVE 2018 20250 | FAST SPREADING| 500 MILLION USERS EXPOSED",
                     "url":"https://titan.intel471.com/post_thread/61bead81b9eee36fde5add081a3425f9?post_uid=c63793e2625349e8f741ebc01f85f151"
                  },
                  {
                     "title":"Критическая уязвимость в WinRAR ставит под угрозу более 500 млн пользователей",
                     "url":"https://titan.intel471.com/post_thread/b81726a9d01dcb4e5734dda1f666f8b6?post_uid=15c55952778dc4103bc04df8200c9ebc"
                  }
               ],
               "patch_status":"available",
               "poc":"observed",
               "counter_measures":"The impacted vendor released patching information for impacted products and corresponding versions. The vendor likely addressed the vulnerability in a version update.",
               "interest_level":{
                  "disclosed_publicly":true,
                  "researched_publicly":true,
                  "exploit_sought":true
               },
               "product_name":"WinRAR",
               "cve_type":"Path traversal",
               "poc_links":[
                  {
                     "title":"Exploit status ",
                     "url":" https://www.exploit-db.com/exploits/46756"
                  }
               ],
               "detection":"available",
               "cvss_score":{
                  "v2":6.8,
                  "v3":7.8
               },
               "underground_activity_summary":"Intel 471 did not observe weaponization or productization of CVE-2018-20250 in the underground. Intel 471 observed several actors post links to open-source articles and a PoC for CVE-2018-20250.",
               "cve_status":"status_historical",
               "underground_activity":"observed",
               "cpe":{
                  "cve_data_version":"4.0",
                  "nodes":[
                     {
                        "operator":"OR",
                        "cpe_match":[
                           {
                              "vulnerable":true,
                              "cpe23Uri":"cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*",
                              "versionEndIncluding":"5.61"
                           }
                        ]
                     }
                  ]
               },
               "summary":"CVE-2018-20250 is a path traversal vulnerability impacting the WinRAR data compression tool’s archive file format (ACE). A proof of concept (PoC) was observed publicly or in the underground."
            }
         },
         "last_updated":1570813574273,
         "uid":"daa5170f9d73629908d8a9170b6c3066",
         "classification":{
            "intel_requirements":[
               "2.1.2.2",
               "2.2.1"
            ]
         },
         "activity":{
            "first":1570556602000,
            "last":1570556602000
         }
      }
   ]
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides