PT-2018-10723 · Dialogic · Dialogic Powermedia Xms

Publicado 2018-07-03 · Atualizado 2019-10-03 · CVE-2018-11639

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dialogic PowerMedia XMS versions prior to 3.5 SU2

Description The issue allows remote attackers to access a user's password in cleartext due to plaintext storage of passwords within cookies in the administrative console. This occurs in the /var/www/xms/application/controllers/verifyLogin.php file.

Recommendations For versions prior to 3.5 SU2, update to version 3.5 SU2 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative console to minimize the risk of exploitation. Avoid using the password variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-11639

Produtos afetados

Dialogic Powermedia Xms

Referências · 3

• 🔥 https://d3adend.org/blog/?p=1398 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11639 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11639 · Aviso do Fabricante