PT-2020-20040 · Unknown+1 · Preferred Providers App+1

Faeeq24 · Published 2020-10-05 · Updated 2020-10-20 · CVE-2020-8228

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Preferred Providers app version 1.7.0

Description A missing rate limit in the Preferred Providers app allowed an attacker to set the password an uncontrolled amount of times.

Recommendations For version 1.7.0, consider implementing a rate limit on password setting to prevent exploitation until a patch is available.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-840

Related Identifiers

CVE-2020-8228

OPENSUSE-SU-2020:1652-1

OPENSUSE-SU-2020_1652-1

Affected Products

Preferred Providers App

Suse

References · 16

• 🔥 https://hackerone.com/reports/922470 · Exploit
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8228 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:1652-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8228 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html · Vendor Advisory
• https://t.me/cibsecurity/15051 · Telegram Post
• https://suse.com/security/cve/CVE-2020-8183 · Note
• https://bugzilla.suse.com/1171579 · Note
• https://bugzilla.suse.com/1171572 · Note
• https://suse.com/security/cve/CVE-2020-8233 · Note
• https://suse.com/security/cve/CVE-2020-8155 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/WWBOJYWMDZM3KUZWE3WE7OUUHDQ6Z7BX · Note
• https://bugzilla.suse.com/1177346 · Note
• https://suse.com/security/cve/CVE-2020-8154 · Note