PT-2019-12330 · Simplybook · Simplybook.Me

Publicado 2019-04-25 · Atualizado 2020-08-24 · CVE-2019-11488

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimplyBook.me Enterprise versions prior to 2019-04-23

Description The issue concerns incorrect access control in the account access/password reset link, allowing unauthorized attackers to read or write customer or administrator data. This can be achieved via a persistent HTTP GET request hash link replay. For example, an attacker could exploit a login link from the browser history.

Recommendations For versions prior to 2019-04-23, update to a version released after 2019-04-23 to resolve the issue. As a temporary workaround, consider restricting access to the account access and password reset functionality until the update is applied. Avoid using the password reset link from the browser history to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-11488

Produtos afetados

Simplybook.Me

Referências · 4

• 🔥 https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf · Exploit
• 🔥 https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11488 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11488 · Aviso do Fabricante