PT-2019-15540 · Energycap · Energycap

Published 2019-11-08 · Updated 2019-11-12 · CVE-2019-18623

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EnergyCAP versions 7 through 7.5.6

Description The issue allows for escalation of privileges, enabling an attacker to access data. This occurs when an unauthenticated user clicks on a link on the public dashboard, causing the resource to open in EnergyCAP with access rights matching the user who created the dashboard.

Recommendations For EnergyCAP versions 7 through 7.5.6, consider restricting access to the public dashboard or limiting the creation of links that could be exploited by unauthenticated users until a fix is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-18623

Affected Products

Energycap

References · 4

• https://energycap.freshdesk.com/support/solutions/articles/31000152837-2019-october-24-security-incident-notification-issue-with-public-dashboards-found-and-resolved · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18623 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18623 · Vendor Advisory
• https://energycap.freshdesk.com/helpdesk/attachments/31016649523 · Vendor Advisory