PT-2020-14837 · Ge Digital · Ge Digital Apm Classic

Published 2020-09-23 · Updated 2021-11-22 · CVE-2020-16244

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Digital APM Classic versions 4.4 and prior

Description The issue is related to a design flaw where salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This, combined with an IDOR vulnerability, puts the entire platform at high risk. An authenticated user can retrieve all user account data and then retrieve the actual passwords.

Recommendations For GE Digital APM Classic versions 4.4 and prior, consider implementing additional security measures to protect user account data, such as using salt for hash calculation of passwords and addressing the IDOR vulnerability to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-759

Related Identifiers

CVE-2020-16244

Affected Products

Ge Digital Apm Classic

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-16244 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16244 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-266-01 · Note
• https://t.me/cvenotify/23598 · Telegram Post