PT-2019-14883 · Enghouse · Enghouse Web Chat

Publicado 2019-11-13 · Atualizado 2021-07-21 · CVE-2019-16951

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Enghouse Web Chat version 6.2.284.34

Description A remote file include issue was discovered, allowing an attacker to replace the localhost attribute with their own domain name. After a POST request is sent, the product calls this domain, retrieving and displaying the attacker's data. The request sent from the product to the attacker reveals sensitive information, including pathnames and internal IP addresses.

Recommendations For Enghouse Web Chat version 6.2.284.34, consider restricting access to the localhost attribute to prevent replacement with an attacker's domain name. As a temporary workaround, restrict the product's ability to call external domains after a POST request is sent, until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2019-16951

Produtos afetados

Enghouse Web Chat

Referências · 3

• 🔥 https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat · Exploit
• https://osv.dev/vulnerability/CVE-2019-16951 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16951 · Nota de Segurança