PT-2019-9154 · 42Gears · Suremdm

Publicado 2019-02-05 · Atualizado 2019-02-19 · CVE-2018-15658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 42Gears SureMDM versions prior to 2018-11-27

Description An issue was discovered that allows an attacker to see the markup presented to an authenticated user by visiting the "/console/ConsolePage/Master.html" API endpoint. This occurs because session validation happens after the initial markup is loaded, resulting in the disclosure of unprotected API endpoints. These endpoints reveal sensitive data, including call logs, SMS logs, and user-account information.

Recommendations For versions prior to 2018-11-27, update to a version released after 2018-11-27 to resolve the issue. As a temporary workaround, consider restricting access to the "/console/ConsolePage/Master.html" endpoint until a patch is available. Additionally, limit access to the disclosed API endpoints to minimize the risk of data exposure.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-15658

Produtos afetados

Suremdm

Referências · 3

• 🔥 https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software · Exploit
• https://osv.dev/vulnerability/CVE-2018-15658 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15658 · Nota de Segurança