PT-2020-13842 · Navigate · Navigate Cms

Sean Wright · Published 2020-06-24 · Updated 2024-06-05 · CVE-2020-14016

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Navigate CMS version 2.9 r1433

Description An issue in the forgot-password feature of Navigate CMS allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not found message when the provided username or email address does not match a user in the system. This can be used to enumerate users.

Recommendations For Navigate CMS version 2.9 r1433, consider modifying the forgot-password feature to return a generic message instead of indicating whether the username or email address is associated with a user, thereby preventing user enumeration. As a temporary workaround, consider restricting access to the forgot-password feature until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2020-14016

Affected Products

Navigate Cms

References · 5

• 🔥 https://blog.sean-wright.com/navigate-cms · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14016 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14016 · Vendor Advisory
• https://t.me/cvenotify/82025 · Telegram Post
• https://cwe.mitre.org/data/definitions/204.html · Note