PT-2011-1359 · Polyvision · Polyvision Roomwizard

Publicado 2011-01-12 · Atualizado 2017-08-17 · CVE-2010-0214

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PolyVision RoomWizard version 3.2.3

Description The issue concerns the administrative interface of the PolyVision RoomWizard, where the Sync Connector Active Directory credentials are placed in a web form accessed over HTTP on port 80. This allows remote attackers to obtain sensitive information by reading the HTML source code corresponding to the "/admin/sign/DeviceSynch" API endpoint.

Recommendations For PolyVision RoomWizard version 3.2.3, consider disabling access to the /admin/sign/DeviceSynch API endpoint until a secure method of handling credentials is implemented. Restrict access to the administrative interface to minimize the risk of exploitation. Avoid using HTTP for sensitive operations; instead, use HTTPS to encrypt the communication.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-0214

Produtos afetados

Polyvision Roomwizard

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2011/Jan/58 · Exploit
• 🔥 http://packetstormsecurity.org/files/view/97291/roomwizard-disclose.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64543 · Nota
• http://vupen.com/english/advisories/2011/0059 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/870601 · Nota
• http://securityfocus.com/bid/45699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0214 · Nota de Segurança