PT-2018-18427 · Datalust · Datalust Seq

Daniel Chactoura · Publicado 2018-03-14 · Atualizado 2019-02-28 · CVE-2018-8096

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Datalust Seq versions prior to 4.2.605

Description: The issue allows for authentication bypass, enabling an attacker to obtain admin access. This can be achieved by sending a PUT request to the "api/settings/setting-isauthenticationenabled" endpoint with the parameter Name set to "isauthenticationenabled" and Value set to false.

Recommendations: For versions prior to 4.2.605, update to version 4.2.605 or later to resolve the issue. As a temporary workaround, consider restricting access to the "api/settings/setting-isauthenticationenabled" endpoint to minimize the risk of exploitation. Avoid using the parameter Name with the value "isauthenticationenabled" and Value set to false in the affected API endpoint until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-8096

Produtos afetados

Datalust Seq

Referências · 5

• 🔥 https://exploit-db.com/exploits/45136 · Exploit
• 🔥 https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732 · Exploit
• https://github.com/datalust/seq-tickets/issues/675 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-8096 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8096 · Aviso do Fabricante