PT-2019-15401 · Clonos · Clonos Web Control Panel

Published 2019-10-24 · Updated 2019-10-29 · CVE-2019-18418

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClonOS WEB control panel version 19.09

Description The issue allows remote attackers to gain full access via change password requests due to the lack of session management in the clonos.php file.

Recommendations For ClonOS WEB control panel version 19.09, consider implementing proper session management to prevent unauthorized access. As a temporary workaround, restrict access to the clonos.php file until a patch is available.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-18418

Affected Products

Clonos Web Control Panel

References · 5

• 🔥❌ https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/47544 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18418 · Security Note
• http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html · Note