PT-2019-11618 · Pterodactyl · Pterodactyl

Dane Everitt · Published 2019-07-29 · Updated 2022-05-24 · CVE-2019-1020002

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 0.7.14

Description: The issue allows malicious users to determine the existence of an account by entering random credentials into the login fields, even when 2FA protections are enabled. This is due to a logical mistake in the original code that waits to verify the user's password until they have provided 2FA credentials. As a result, entering a bad password for a known email can reveal if the account exists by checking if the user is redirected to a 2FA page.

Recommendations: For versions prior to 0.7.14, update to version 0.7.14 or later to resolve the issue. As a temporary workaround, consider disabling 2FA until the update is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2019-1020002

GHSA-FG52-XJFC-9RH8

GHSA-VCM9-HX3Q-QWJ8

Affected Products

Pterodactyl

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-1020002 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1020002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fg52-xjfc-9rh8 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8 · Note
• https://github.com/pterodactyl/panel/releases/tag/v0.7.14 · Note
• https://github.com/pterodactyl/panel/commit/092e7e79fff858ee026608c7dbccab165a67526f · Note