PT-2020-13286 · Ismartgate · Ismartgate Pro

Published 2020-09-24 · Updated 2020-09-27 · CVE-2020-12840

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9

Description The issue allows remote attackers to upload sound files via the "/index.php" API endpoint, potentially leading to unauthorized access or data modification.

Recommendations For ismartgate PRO version 1.5.9, consider implementing proper CSRF protection mechanisms to prevent unauthorized requests, such as validating tokens or using same-site cookies to restrict access to the "/index.php" endpoint.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-12840

Affected Products

Ismartgate Pro

References · 4

• 🔥 https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2020-12840 · Vendor Advisory
• https://ismartgate.com/secure-garage-door · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12840 · Security Note