PT-2019-12006 · Verodin · Verodin Director

Publicado 2019-10-20 · Atualizado 2022-01-01 · CVE-2019-10716

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Verodin Director versions 3.5.3.1 and earlier

Description The issue allows disclosure of usernames and passwords of integrated security technologies. This is achieved through a "/integrations.json" JSON REST API request.

Recommendations For versions 3.5.3.1 and earlier, update to a version later than 3.5.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/integrations.json" API endpoint to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-10716

Produtos afetados

Verodin Director

Referências · 7

• 🔥 http://nolanbkennedy.com/post/cve-2019-10716-information-disclosure-verodin-director · Exploit
• 🔥 http://packetstormsecurity.com/files/156214/Verodin-Director-Web-Console-3.5.4.0-Password-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/48002 · Exploit
• https://verodin.com/technology/platform · Nota
• https://osv.dev/vulnerability/CVE-2019-10716 · Aviso do Fabricante
• https://verodin.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10716 · Nota de Segurança