PT-2019-15176 · Kirona · Kirona Dynamic Resource Scheduling

Ramikan · Published 2019-10-11 · Updated 2021-07-21 · CVE-2019-17503

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kirona Dynamic Resource Scheduling (DRS) version 5.5.3.5

Description An issue in Kirona Dynamic Resource Scheduling (DRS) allows an unauthenticated user to access the "/osm/REGISTER.cmd" (also known as "/osm tiles/REGISTER.cmd") endpoint directly. This endpoint contains sensitive information about the database through SQL queries within the batch file, exposing details such as database version, table name, and column name.

Recommendations For version 5.5.3.5, consider restricting access to the "/osm/REGISTER.cmd" endpoint to prevent unauthorized users from accessing sensitive database information. As a temporary workaround, restrict access to this endpoint until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2019-17503

Affected Products

Kirona Dynamic Resource Scheduling

References · 5

• 🔥 https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/47498 · Exploit
• 🔥 http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17503 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17503 · Vendor Advisory