PT-2019-19917 · Eclass · Eclass

Published 2019-07-25 · Updated 2020-10-16 · CVE-2019-9884

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1

Description The issue allows an attacker to bypass password validation and access the management page by using the GET method to request the /admin page.

Recommendations For eClass platform version ip.2.5.10.2.1, consider restricting access to the /admin page until a fix is available. As a temporary workaround, limit the use of the GET method for requesting the /admin page to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-425

Related Identifiers

CVE-2019-9884

Affected Products

Eclass

References · 5

• 🔥 https://zeroday.hitcon.org/vulnerability/ZD-2019-00332 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9884 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9884 · Vendor Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201904004 · Note
• http://surl.twcert.org.tw/b7jfz · Note