PT-2014-4561 · Posh · Posh

Publicado 2014-04-01 · Atualizado 2014-04-02 · CVE-2014-2212

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions POSH versions 3.0 through 3.3.0 and earlier

Description The issue concerns the storage of sensitive user information in cookies. Specifically, the remember me feature in the portal/scr authentif.php file stores the username and MD5 digest of the password in cleartext in a cookie. This allows attackers to obtain sensitive information by reading this cookie.

Recommendations For POSH versions 3.0 through 3.3.0 and earlier, consider disabling the remember me feature in the portal/scr authentif.php file until a secure alternative is implemented. Restrict access to sensitive information stored in cookies to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-2212

Produtos afetados

Posh

Referências · 4

• 🔥 http://sysdream.com/CVE-2014-2211_2214 · Exploit
• 🔥 http://sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf · Exploit
• http://seclists.org/oss-sec/2014/q1/444 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2212 · Nota de Segurança