PT-2020-15667 · Playground Sessions · Playground Sessions

Nathunandwani · Published 2020-11-23 · Updated 2020-12-02 · CVE-2020-24227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Playground Sessions versions 2.5.582 and earlier

Description The issue allows anyone with access to UserProfiles.sol to extract the email and password because user credentials are stored in plain text. This affects Playground Sessions for Windows, where the vulnerable file is located at C:UsersAppDataRoamingPlaygroundLocal Store#SharedObjectsPlayground.swfUserProfiles.sol.

Recommendations For versions 2.5.582 and earlier, consider removing or securing access to the UserProfiles.sol file to prevent unauthorized extraction of user credentials until a patch is available. As a temporary workaround, restrict access to the UserProfiles.sol file to minimize the risk of exploitation. Avoid using the email and password variables in the affected storage mechanism until the issue is resolved.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-24227

Affected Products

Playground Sessions

References · 8

• 🔥 https://github.com/nathunandwani/CVE-2020-24227 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24227 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24227 · Vendor Advisory
• https://t.me/ckure/6135 · Telegram Post
• https://t.me/cvenotify/6065 · Telegram Post
• https://t.me/cvenotify/6475 · Telegram Post
• https://t.me/cibsecurity/16757 · Telegram Post
• https://t.me/freedomf0x/10810 · Telegram Post