PT-2019-12330 · Simplybook · Simplybook.Me

Published 2019-04-25 · Updated 2020-08-24 · CVE-2019-11488

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimplyBook.me Enterprise versions prior to 2019-04-23

Description The issue concerns incorrect access control in the account access/password reset link, allowing unauthorized attackers to read or write customer or administrator data. This can be achieved via a persistent HTTP GET request hash link replay. For example, an attacker could exploit a login link from the browser history.

Recommendations For versions prior to 2019-04-23, update to a version released after 2019-04-23 to resolve the issue. As a temporary workaround, consider restricting access to the account access and password reset functionality until the update is applied. Avoid using the password reset link from the browser history to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-11488

Affected Products

Simplybook.Me

References · 4

• 🔥 https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf · Exploit
• 🔥 https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11488 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11488 · Vendor Advisory