PT-2020-20592 · Golfbuddy · Golfbuddy Course Manager

Published 2020-02-26 · Updated 2021-07-21 · CVE-2020-9337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GolfBuddy Course Manager version 1.1

Description The issue involves sending passwords via a GET request with base64 encoding. This is a security concern as sensitive information like passwords should not be transmitted in such a manner due to potential exposure.

Recommendations For GolfBuddy Course Manager version 1.1, consider modifying the application to send passwords via a POST request instead, and ensure proper encryption methods are used to protect sensitive data. As a temporary workaround, restrict access to the application until a proper fix can be implemented.

Exploit

Fix

Information Disclosure

Inadequate Encryption Strength

Weakness Enumeration

CWE-200

CWE-326

Related Identifiers

CVE-2020-9337

Affected Products

Golfbuddy Course Manager

References · 5

• 🔥 https://github.com/0xEmma/CVEs/blob/master/CVEs/CVE-2020-9337-Golf-Buddy-Insecure-Passwords.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-9337 · Vendor Advisory
• https://help.golfbuddyglobal.com/sList.asp?searchproduct=29&searchcategory=5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9337 · Security Note
• https://t.me/cvenotify/1239 · Telegram Post