PT-2020-14738 · 1Crm · 1Crm System

Published 2020-09-15 · Updated 2021-07-21 · CVE-2020-15958

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 1CRM System versions through 8.6.7

Description An issue allows a remote attacker to access sensitive information via an unauthenticated request with a predictable URL due to an insecure direct object reference to internally stored files.

Recommendations For 1CRM System versions through 8.6.7, as a temporary workaround, consider restricting access to internally stored files until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-15958

Affected Products

1Crm System

References · 7

• 🔥 http://seclists.org/fulldisclosure/2020/Sep/31 · Exploit
• 🔥 http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-15958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15958 · Security Note
• https://1crm.com/documentation · Note
• https://t.me/defcon_news/57046 · Telegram Post
• https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-1crm-schutzt-daten-unzureichend-cve-2020-15958 · Note