PT-2020-10343 · Testlink · Testlink

Published 2020-03-05 · Updated 2020-03-07 · CVE-2019-20107

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TestLink versions 1.9.19 and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands via several parameters, including tproject id to "keywordsView.php", req spec id to "reqSpecCompareRevisions.php", requirement id to "reqCompareVersions.php", build id to "planUpdateTC.php", tplan id to "newest tcversions.php" and "tcCreatedPerUserGUI.php", tcase id to "tcAssign2Tplan.php", or testcase id to "tcCompareVersions.php". Authentication can often be easily achieved as a guest account, which can execute this attack, can be created by anyone in the default configuration.

Recommendations For TestLink versions 1.9.19 and earlier, update to a version later than 1.9.19 to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "keywordsView.php", "reqSpecCompareRevisions.php", "reqCompareVersions.php", "planUpdateTC.php", "newest tcversions.php", "tcCreatedPerUserGUI.php", "tcAssign2Tplan.php", and "tcCompareVersions.php", until a patch is available. Additionally, limit the creation of guest accounts to prevent unauthorized access.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-20107

Affected Products

Testlink

References · 12

• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/942c406fcee5d376235a264cb8a79300a0002d20 · Patch
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/e2d88c9d7f8e02640ba65e5ff74b55d0399a53d0 · Patch
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/d27690c6cb7708a6db0701b6428381d32d51495a · Patch
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/7647a7b53ceab31524cfcfb3beb8435af0a30fc1 · Patch
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/146b4f38010a48c36b7d9650060ca354c92ab4ac · Patch
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/bcf7b971b5c88ea08d2dc47685f319be3b02cea8 · Patch
• https://osv.dev/vulnerability/CVE-2019-20107 · Vendor Advisory
• http://mantis.testlink.org/view.php?id=8829#c29360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20107 · Security Note
• http://mantis.testlink.org/view.php?id=8829 · Vendor Advisory
• https://t.me/cvenotify/1372 · Telegram Post
• https://twitter.com/TLOpenSource/status/1212394020946751489 · Note