PT-2019-14369 · Sitos · Sitos Six

Published 2019-10-07 · Updated 2019-10-09 · CVE-2019-15749

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SITOS six Build version 6.2.1

Description The issue allows a user to change their password and recovery email address without confirming the change with their old password. This could be exploited by an attacker with access to the victim's account, for example, via XSS or an unattended workstation, to change the password and address.

Recommendations For SITOS six Build version 6.2.1, consider implementing a confirmation step for password and recovery email address changes, requiring the user to enter their old password to authorize the change. As a temporary workaround, restrict access to account settings to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2019-15749

Affected Products

Sitos Six

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-15749 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15749 · Vendor Advisory
• https://contextis.com/en/resources/advisories/cve-2019-15749 · Note