PT-2019-13984 · Tyto · Tyto Sahi Pro

Goutham Madhwaraj · Publicado 2019-09-06 · Atualizado 2020-08-24 · CVE-2019-15102

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tyto Sahi Pro versions 6.x through 8.0.0

Description An issue in TestRunner Non distributed and distributed endpoints allows an attacker to execute arbitrary scripts on the remote Sahi Pro server due to the lack of an authentication mechanism. Additionally, the password-protected web interface for remote script access lacks server-side validation, enabling an attacker to create, modify, or delete scripts without a password. Combining these issues can result in remote code execution on the Sahi Pro server.

Recommendations For Tyto Sahi Pro versions 6.x through 8.0.0, consider disabling the TestRunner Non distributed and distributed endpoints until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the web interface for remote script access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-15102

Produtos afetados

Tyto Sahi Pro

Referências · 3

• 🔥 https://barriersec.com/2019/08/cve-2019-15102-sahi-pro · Exploit
• https://osv.dev/vulnerability/CVE-2019-15102 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15102 · Nota de Segurança