PT-2020-10332 · Mfscripts · Mfscripts Yetishare

Published 2020-02-10 · Updated 2020-02-11 · CVE-2019-20061

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.4

Description The issue concerns the user-introduction email in MFScripts YetiShare, where the system-picked password may be leaked if the email is sent in cleartext. This means the user does not have the option to choose their initial password.

Recommendations For versions 3.5.2 through 4.5.4, consider configuring the email settings to use encryption, such as TLS, to protect the password in transit. As a temporary workaround, restrict the use of cleartext emails for user introductions until a more secure method is implemented.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-20061

Affected Products

Mfscripts Yetishare

References · 6

• 🔥 https://medium.com/@jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad · Exploit
• https://osv.dev/vulnerability/CVE-2019-20061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20061 · Security Note
• https://yetishare.com · Note
• https://mfscripts.com · Note
• https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad · Note