PT-2019-14883 · Enghouse · Enghouse Web Chat

Published 2019-11-13 · Updated 2021-07-21 · CVE-2019-16951

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Enghouse Web Chat version 6.2.284.34

Description A remote file include issue was discovered, allowing an attacker to replace the localhost attribute with their own domain name. After a POST request is sent, the product calls this domain, retrieving and displaying the attacker's data. The request sent from the product to the attacker reveals sensitive information, including pathnames and internal IP addresses.

Recommendations For Enghouse Web Chat version 6.2.284.34, consider restricting access to the localhost attribute to prevent replacement with an attacker's domain name. As a temporary workaround, restrict the product's ability to call external domains after a POST request is sent, until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2019-16951

Affected Products

Enghouse Web Chat

References · 3

• 🔥 https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat · Exploit
• https://osv.dev/vulnerability/CVE-2019-16951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16951 · Security Note