PT-2019-15084 · Clipsoft · Clipsoft Rexpert

Published 2019-10-30 · Updated 2019-11-01 · CVE-2019-17321

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ClipSoft REXPERT versions 1.0.0.527 and earlier

Description The issue is related to information disclosure. When a web page associated with a session is requested, it could potentially leak the username via the session file path in the HTTP response data. Notably, this issue can be exploited without requiring any authentication.

Recommendations For ClipSoft REXPERT versions 1.0.0.527 and earlier, consider restricting access to session-related web pages until a fix is available. As a temporary workaround, avoid using the session file path in HTTP responses to minimize the risk of username leakage. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-17321

Affected Products

Clipsoft Rexpert

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-17321 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17321 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184 · Note