PT-2019-15176 · Kirona · Kirona Dynamic Resource Scheduling

Ramikan · Publicado 2019-10-11 · Atualizado 2021-07-21 · CVE-2019-17503

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kirona Dynamic Resource Scheduling (DRS) version 5.5.3.5

Description An issue in Kirona Dynamic Resource Scheduling (DRS) allows an unauthenticated user to access the "/osm/REGISTER.cmd" (also known as "/osm tiles/REGISTER.cmd") endpoint directly. This endpoint contains sensitive information about the database through SQL queries within the batch file, exposing details such as database version, table name, and column name.

Recommendations For version 5.5.3.5, consider restricting access to the "/osm/REGISTER.cmd" endpoint to prevent unauthorized users from accessing sensitive database information. As a temporary workaround, restrict access to this endpoint until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2019-17503

Produtos afetados

Kirona Dynamic Resource Scheduling

Referências · 5

• 🔥 https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/47498 · Exploit
• 🔥 http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17503 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17503 · Aviso do Fabricante