PT-2019-15084 · Clipsoft · Clipsoft Rexpert

Publicado 2019-10-30 · Atualizado 2019-11-01 · CVE-2019-17321

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ClipSoft REXPERT versions 1.0.0.527 and earlier

Description The issue is related to information disclosure. When a web page associated with a session is requested, it could potentially leak the username via the session file path in the HTTP response data. Notably, this issue can be exploited without requiring any authentication.

Recommendations For ClipSoft REXPERT versions 1.0.0.527 and earlier, consider restricting access to session-related web pages until a fix is available. As a temporary workaround, avoid using the session file path in HTTP responses to minimize the risk of username leakage. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-17321

Produtos afetados

Clipsoft Rexpert

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-17321 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17321 · Aviso do Fabricante
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184 · Nota