PT-2014-4561 · Posh · Posh

Published 2014-04-01 · Updated 2014-04-02 · CVE-2014-2212

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions POSH versions 3.0 through 3.3.0 and earlier

Description The issue concerns the storage of sensitive user information in cookies. Specifically, the remember me feature in the portal/scr authentif.php file stores the username and MD5 digest of the password in cleartext in a cookie. This allows attackers to obtain sensitive information by reading this cookie.

Recommendations For POSH versions 3.0 through 3.3.0 and earlier, consider disabling the remember me feature in the portal/scr authentif.php file until a secure alternative is implemented. Restrict access to sensitive information stored in cookies to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-2212

Affected Products

Posh

References · 4

• 🔥 http://sysdream.com/CVE-2014-2211_2214 · Exploit
• 🔥 http://sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2212 · Security Note
• http://seclists.org/oss-sec/2014/q1/444 · Note