PT-2019-18690 · Prima Systems · Flexair

Gjoko Krstic · Publicado 2019-07-01 · Atualizado 2022-10-21 · CVE-2019-7667

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prima Systems FlexAir versions 2.3.38 and prior

Description The application generates database backup files with a predictable name, allowing an attacker to use brute force to identify the database backup file name. This can be exploited to download the database file, disclose login information, and bypass authentication, resulting in full access to the system.

Recommendations For versions 2.3.38 and prior, as a temporary workaround, consider restricting access to the database backup files until a patch is available. To fully resolve the issue, update to a version later than 2.3.38, which should include a fix for the predictable database backup file name generation.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2019-7667

Produtos afetados

Flexair

Referências · 6

• 🔥 http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7667 · Nota de Segurança
• https://applied-risk.com/resources/ar-2019-007 · Nota
• https://us-cert.gov/ics/advisories/icsa-19-211-02 · Nota
• https://osv.dev/vulnerability/CVE-2019-7667 · Aviso do Fabricante
• https://applied-risk.com/labs/advisories · Nota