PT-2020-20639 · Ibl · Ibl Online Weather

Dawid Czarnecki · Published 2020-02-25 · Updated 2023-09-28 · CVE-2020-9407

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBL Online Weather versions prior to 4.3.5a

Description The issue allows attackers to obtain sensitive information by reading the IWEBSERVICE JSONRPC COOKIE cookie.

Recommendations For versions prior to 4.3.5a, update to version 4.3.5a or later to resolve the issue. As a temporary workaround, consider restricting access to the IWEBSERVICE JSONRPC COOKIE cookie to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-9407

Affected Products

Ibl Online Weather

References · 5

• https://osv.dev/vulnerability/CVE-2020-9407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9407 · Security Note
• https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather · Note
• https://zigrin.com/advisories/online-weather-information-disclosure-in-cookie · Note
• https://t.me/cvenotify/1238 · Telegram Post