PT-2020-13561 · Nch · Nch Express Accounts

Tejas Nitin Pingulkar · Published 2020-12-28 · Updated 2021-07-21 · CVE-2020-13474

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NCH Express Accounts versions 8.24 and earlier

Description The issue allows an authenticated low-privilege user to access higher-privileged functionalities, such as Add/Edit users, by entering a crafted URL.

Recommendations For versions 8.24 and earlier, update to a version later than 8.24 to resolve the issue. As a temporary workaround, consider restricting access to sensitive functionalities such as Add/Edit users until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2020-13474

Affected Products

Nch Express Accounts

References · 5

• 🔥 https://cvewalkthrough.com/cve-2020-13474-nch-express-accounts-privilege-escalation · Exploit
• 🔥 https://tejaspingulkar.blogspot.com/2020/12/cve-2020-13474-nch-express-accounts.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13474 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13474 · Vendor Advisory
• https://t.me/cvenotify/7852 · Telegram Post