PT-2019-13562 · Publisure · Publisure

Bourbon Jean-Marie + 1 · Published 2019-09-18 · Updated 2020-08-24 · CVE-2019-14253

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Publisure version 2.1.2

Description An issue in the servlet controller of the secure portal allows authentication bypass, enabling unauthorized queries on PHP forms within the /AdminDir folder, which should be restricted.

Recommendations For Publisure version 2.1.2, consider restricting access to the /AdminDir folder and its PHP forms until a patch is available. As a temporary workaround, review and strengthen authentication mechanisms to prevent bypass attempts.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-14253

Affected Products

Publisure

References · 3

• 🔥 https://github.com/kmkz/exploit/blob/master/PUBLISURE-EXPLOIT-CHAIN-ADVISORY.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14253 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14253 · Vendor Advisory