PT-2020-19481 · Evoko · Evoko Home

Published 2020-01-19 · Updated 2020-01-28 · CVE-2020-7231

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Evoko Home version 1.31

Description The issue concerns different error messages being provided for failed login requests, depending on whether the username is valid. This distinction in error messages could potentially be used to determine valid usernames.

Recommendations For Evoko Home version 1.31, consider modifying the login error response to provide a generic message that does not distinguish between valid and invalid usernames until a patch is available. As a temporary workaround, restrict access to the login functionality to minimize the risk of exploitation.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2020-7231

Affected Products

Evoko Home

References · 4

• 🔥 https://sku11army.blogspot.com/2020/01/evoko-otra-sala-por-favor.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7231 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7231 · Vendor Advisory
• https://t.me/cvenotify/330 · Telegram Post