PT-2020-17358 · Kronos · Kronos Webta

Published 2020-12-21 · Updated 2020-12-22 · CVE-2020-35604

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kronos WebTA version 5.0.4

Description An XXE attack can occur when SAML is used.

Recommendations For Kronos WebTA version 5.0.4, consider disabling SAML until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-35604

Affected Products

Kronos Webta

References · 4

• 🔥 https://mindpointgroup.com/blog/webta-xxe-version-5-0-4-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2020-35604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35604 · Security Note
• https://t.me/cibsecurity/21136 · Telegram Post