PT-2019-19917 · Eclass · Eclass

Publicado 2019-07-25 · Atualizado 2020-10-16 · CVE-2019-9884

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1

Description The issue allows an attacker to bypass password validation and access the management page by using the GET method to request the /admin page.

Recommendations For eClass platform version ip.2.5.10.2.1, consider restricting access to the /admin page until a fix is available. As a temporary workaround, limit the use of the GET method for requesting the /admin page to minimize the risk of exploitation.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-425

Identificadores relacionados

CVE-2019-9884

Produtos afetados

Eclass

Referências · 5

• 🔥 https://zeroday.hitcon.org/vulnerability/ZD-2019-00332 · Exploit
• https://tvn.twcert.org.tw/taiwanvn/TVN-201904004 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9884 · Nota de Segurança
• http://surl.twcert.org.tw/b7jfz · Nota
• https://osv.dev/vulnerability/CVE-2019-9884 · Aviso do Fabricante