PT-2017-12588 · Slims · Slims

Trichimtrich · Publicado 2017-08-06 · Atualizado 2020-06-16 · CVE-2017-12584

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SLiMS versions 8 Akasia through 8.3.1

Description The issue allows remote attackers to perform a complete account takeover by tricking a user into changing their password to an attacker-controlled one. This is possible because there is no CSRF mitigation and the user profile, including the password, can be updated without requiring the current password. The passwd1 and passwd2 fields in the admin/modules/system/app user.php endpoint, specifically when changecurrent=true, are vulnerable to this attack.

Recommendations For SLiMS versions 8 Akasia through 8.3.1, consider implementing CSRF mitigation measures and require the current password to be sent when updating the user profile, including the password, to prevent unauthorized changes. As a temporary workaround, restrict access to the admin/modules/system/app user.php endpoint, especially when changecurrent=true, to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-12584

Produtos afetados

Slims

Referências · 3

• 🔥 https://github.com/slims/slims8_akasia/issues/49 · Exploit
• https://osv.dev/vulnerability/CVE-2017-12584 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12584 · Nota de Segurança