PT-2017-12173 · Unknown · Hashtopussy

Ghost · Publicado 2017-07-27 · Atualizado 2019-10-03 · CVE-2017-11681

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hashtopussy version 0.4.0

Description The issue allows remote authenticated users to execute actions that should only be available for administrative roles. This can be demonstrated by sending an action=createVoucher request to the "agents.php" endpoint.

Recommendations For version 0.4.0, consider restricting access to the "agents.php" endpoint until a patch is available, and limit the execution of actions that should only be available for administrative roles.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2017-11681

Produtos afetados

Hashtopussy

Referências · 3

• 🔥 https://github.com/s3inlc/hashtopussy/issues/241 · Exploit
• https://osv.dev/vulnerability/CVE-2017-11681 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11681 · Nota de Segurança