PT-2019-15224 · Eyecomms · Eyecms

Ahmyth · Publicado 2019-11-07 · Atualizado 2020-08-24 · CVE-2019-17604

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions eyecomms eyeCMS versions prior to 2019-10-15

Description The issue allows any candidate to modify other candidates' personal information, including first name, last name, email, CV, phone number, and other details, by altering the id parameter. This is an Insecure Direct Object Reference (IDOR) vulnerability.

Recommendations For versions prior to 2019-10-15, as a temporary workaround, consider restricting access to the id parameter to prevent unauthorized changes to candidate information. Additionally, avoid using the id parameter in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-17604

Produtos afetados

Eyecms

Referências · 4

• 🔥 https://gist.github.com/AhMyth/b0f7e4b8244def8eb8d7d8c61fa6d4e5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17604 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17604 · Aviso do Fabricante
• http://eyecomms.com/Products/eyeCMS.html · Aviso do Fabricante