PT-2019-13979 · Prise · Prise Adas

Publicado 2019-09-20 · Atualizado 2020-08-24 · CVE-2019-15088

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PRiSE adAS version 1.7.0

Description An issue was discovered where password hashes are compared using the equality operator, allowing potential bypass of login authentication under specific circumstances.

Recommendations For PRiSE adAS version 1.7.0, consider updating the authentication mechanism to use a secure comparison method to prevent potential bypass of login authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2019-15088

Produtos afetados

Prise Adas

Referências · 4

• http://adas-sso.com/es/extra/download.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15088 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15088 · Aviso do Fabricante
• https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas · Correção