PT-2020-17240 · Lan · Lan Atmservice M3 Atm Monitoring System

Dmitry Kuramin · Published 2020-12-10 · Updated 2020-12-14 · CVE-2020-29666

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lan ATMService M3 ATM Monitoring System version 6.1.0

Description A directory-listing issue allows a remote attacker to view log files located in /websocket/logs/, which contain a user's cookie values and the predefined developer's cookie value.

Recommendations For Lan ATMService M3 ATM Monitoring System version 6.1.0, consider restricting access to the /websocket/logs/ directory to prevent unauthorized viewing of log files until a patch is available. As a temporary workaround, restrict access to the vulnerable websocket module to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-29666

Affected Products

Lan Atmservice M3 Atm Monitoring System

References · 24

• 🔥 https://github.com/jet-pentest/CVE-2020-29666 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29666 · Security Note
• http://lanatmservice.ru · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29666 · Vendor Advisory
• https://t.me/cibsecurity/18913 · Telegram Post
• https://t.me/cibsecurity/18739 · Telegram Post
• https://t.me/cibsecurity/18932 · Telegram Post
• https://t.me/cibsecurity/19009 · Telegram Post
• https://t.me/cibsecurity/18855 · Telegram Post
• https://t.me/cibsecurity/18816 · Telegram Post
• https://t.me/cvenotify/6935 · Telegram Post
• https://t.me/cibsecurity/18719 · Telegram Post
• https://t.me/cibsecurity/18759 · Telegram Post
• https://t.me/cibsecurity/18990 · Telegram Post
• https://t.me/cibsecurity/19029 · Telegram Post