PT-2014-5006 · Open Assessment Technologies · Tao

Published 2014-05-13 · Updated 2014-05-16 · CVE-2014-2989

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Assessment Technologies TAO version 2.5.6

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to "Users/add".

Recommendations For Open Assessment Technologies TAO version 2.5.6, consider disabling the account creation functionality until a patch is available to prevent exploitation. Restrict access to the "Users/add" endpoint to minimize the risk of unauthorized administrative account creation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-2989

Affected Products

Tao

References · 5

• 🔥 https://htbridge.com/advisory/HTB23211 · Exploit
• 🔥 https://exploit-db.com/exploits/39176 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2989 · Security Note
• http://secunia.com/advisories/58539 · Vendor Advisory
• http://securityfocus.com/bid/67291 · Note