PT-2020-20564 · Ice · Ice Hrm

J3Rrybl4Nks · Published 2020-02-18 · Updated 2020-02-19 · CVE-2020-9270

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ICE Hrm version 26.2.0

Description The issue allows for CSRF, leading to unauthorized password reset through the "service.php" endpoint.

Recommendations For ICE Hrm version 26.2.0, update to a version that includes a fix for this issue, as no specific workaround is provided.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-9270

Affected Products

Ice Hrm

References · 3

• 🔥 https://github.com/J3rryBl4nks/IceHRM/blob/master/ChangeUserPasswordCSRF.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9270 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9270 · Vendor Advisory