PT-2019-14369 · Sitos · Sitos Six

Publicado 2019-10-07 · Atualizado 2019-10-09 · CVE-2019-15749

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1

Description The issue allows a user to change their password and recovery email address without confirming the change with their old password. This could be exploited by an attacker with access to the victim's account, for example, via XSS or an unattended workstation, to change the password and address.

Recommendations For SITOS six Build version 6.2.1, consider implementing a confirmation step for password and recovery email address changes, requiring the user to enter their old password to authorize the change. As a temporary workaround, restrict access to account settings to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2019-15749

Produtos afetados

Sitos Six

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-15749 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15749 · Aviso do Fabricante
• https://contextis.com/en/resources/advisories/cve-2019-15749 · Nota