PT-2020-19878 · Labvantage · Labvantage Lims

Published 2020-02-17 · Updated 2021-07-21 · CVE-2020-7959

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LabVantage LIMS version 8.3

Description The issue concerns the exposure of database names through the web application, potentially allowing an attacker to enumerate database names by manipulating requests. For instance, providing a non-existent database name in a request may yield an 'Unrecognized Database' exception message, indicating the database does not exist.

Recommendations For LabVantage LIMS version 8.3, consider restricting access to the web application to minimize the risk of database name enumeration until a proper fix is implemented. Additionally, avoid using the database name in requests to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-7959

Affected Products

Labvantage Lims

References · 4

• 🔥 https://github.com/websecnl/LabVantage8.3-Exploit · Exploit
• 🔥 https://exploit-db.com/exploits/48090 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7959 · Security Note