PT-2019-12941 · Thoughtspot · Thoughtspot

Published 2019-07-09 · Updated 2020-08-24 · CVE-2019-12782

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThoughtSpot versions 4.4.1 through 5.1.1

Description The issue allows a low-privilege user with write access to at least one pinboard to corrupt pinboards of another user in the application by spoofing GUIDs in pinboard update requests, effectively deleting them.

Recommendations For ThoughtSpot versions 4.4.1 through 5.1.1, update to version 5.1.2 or later to resolve the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-12782

Affected Products

Thoughtspot

References · 5

• https://osv.dev/vulnerability/CVE-2019-12782 · Vendor Advisory
• https://docs.thoughtspot.com/5.1/release/notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12782 · Security Note
• https://vsecurity.com/download/advisories/201912782-1.txt · Note
• https://vsecurity.com/resources/advisories.html · Note