PT-2020-12870 · Rukovoditel · Rukovoditel

Published 2020-04-27 · Updated 2021-07-21 · CVE-2020-11821

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rukovoditel version 2.5.2

Description The issue concerns the storage of users' passwords and usernames in a cookie, which uses URL encoding, base64 encoding, and hashing. This makes it possible for an attacker to apply brute force on them.

Recommendations For Rukovoditel version 2.5.2, consider implementing additional security measures to protect user credentials, such as using a secure protocol for cookie transmission and limiting the number of login attempts to prevent brute-force attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-11821

Affected Products

Rukovoditel

References · 4

• 🔥 https://fatihhcelik.blogspot.com/2020/01/rukovoditel-password-hash-in-cookie-url.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11821 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11821 · Vendor Advisory
• https://t.me/cvenotify/3241 · Telegram Post