PT-2018-15301 · Steve Pallen · Coherence

Griffinmb · Published 2018-12-20 · Updated 2022-02-10 · CVE-2018-20301

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Steve Pallen Coherence versions prior to 0.5.2

Description An issue similar to a Mass Assignment vulnerability was discovered, affecting "registration" endpoints such as creating, editing, and updating. This allows users to update any coherence fields data. For instance, users can automatically confirm their accounts by sending the confirmed at parameter with their registration request to the "registration" endpoint.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the confirmed at parameter in registration requests until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-20301

GHSA-MRQ8-53R4-3J5M

Affected Products

Coherence

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-20301 · Security Note
• https://osv.dev/vulnerability/GHSA-mrq8-53r4-3j5m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20301 · Vendor Advisory
• https://github.com/smpallen99/coherence/issues/270 · Note
• https://github.com/smpallen99/coherence · Note