PT-2010-3533 · Consona · Dynamic Agent+2

Rubén Santamarta · Published 2010-05-11 · Updated 2018-10-10 · CVE-2010-1910

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Consona Live Assistance, Dynamic Agent, and Subscriber Assistance (affected versions not specified)

Description The issue concerns the Forgot Password implementation, which allows remote attackers to reset passwords of certain accounts. This can be achieved by sending empty values for the Hint questions and Hint answers fields, specifically targeting accounts with blank values for these fields.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-1910

Affected Products

Consona Live Assistance

Dynamic Agent

Subscriber Assistance

References · 7

• http://consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf · Vendor Advisory
• http://secunia.com/advisories/39740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1910 · Security Note
• http://kb.cert.org/vuls/id/602801 · Patch
• http://securityfocus.com/bid/40003 · Note
• http://securityfocus.com/archive/1/511176/100/0/threaded · Note
• http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html · Note