PT-2020-10302 · Dradis · Dradis Pro

Bastian Faure + 1 · Published 2020-03-16 · Updated 2021-07-21 · CVE-2019-19946

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dradis Pro version 3.4.1

Description The issue allows any user to extract the content of a project, even if the user is not part of the project team, through the API.

Recommendations For Dradis Pro version 3.4.1, consider restricting access to the API to prevent unauthorized project content extraction until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-19946

Affected Products

Dradis Pro

References · 5

• 🔥 https://know.bishopfox.com/advisories/dradis-pro-3-4-1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19946 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19946 · Vendor Advisory
• https://know.bishopfox.com/advisories · Note
• https://t.me/cvenotify/1767 · Telegram Post