PT-2020-10264 · Serpico · Serpico

Published 2020-01-15 · Updated 2021-07-21 · CVE-2019-19857

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0

Description The issue allows an admin to change their password without providing the current password by utilizing interfaces outside the Change Password screen. This is particularly problematic when combined with cross-site scripting (XSS) attacks, as it undermines the security enhancement of requiring the admin to enter their old password on the Change Password screen.

Recommendations For Serpico version 1.3.0, consider restricting access to interfaces that allow password changes outside the Change Password screen as a temporary workaround until a patch is available. Additionally, ensure that all users, especially admins, are cautious when clicking on links or providing sensitive information to minimize the risk of XSS exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-19857

Affected Products

Serpico

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-19857 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19857 · Vendor Advisory
• https://websec.nl/news.php · Note