PT-2020-13086 · Testlink · Testlink

Published 2020-04-27 · Updated 2021-07-21 · CVE-2020-12273

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.20

Description A crafted viewer parameter in the login.php endpoint exposes cleartext credentials.

Recommendations For TestLink version 1.9.20, avoid using the viewer parameter in the login.php endpoint until the issue is resolved.

Exploit

Fix

Missing Encryption of Sensitive Data

Insufficiently Protected Credentials

Weakness Enumeration

CWE-311

CWE-522

Related Identifiers

CVE-2020-12273

Affected Products

Testlink

References · 4

• 🔥 http://mantis.testlink.org/view.php?id=8895 · Exploit
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/72271ef057e6e4a95c6128973902ea646f7b5462 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-12273 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12273 · Vendor Advisory