PT-2017-12173 · Unknown · Hashtopussy

Ghost · Published 2017-07-27 · Updated 2019-10-03 · CVE-2017-11681

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hashtopussy version 0.4.0

Description The issue allows remote authenticated users to execute actions that should only be available for administrative roles. This can be demonstrated by sending an action=createVoucher request to the "agents.php" endpoint.

Recommendations For version 0.4.0, consider restricting access to the "agents.php" endpoint until a patch is available, and limit the execution of actions that should only be available for administrative roles.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-11681

Affected Products

Hashtopussy

References · 3

• 🔥 https://github.com/s3inlc/hashtopussy/issues/241 · Exploit
• https://osv.dev/vulnerability/CVE-2017-11681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11681 · Security Note