PT-2020-3962 · Wibu Systems · Codemeter

Published 2020-09-07 · Updated 2020-09-22 · CVE-2020-14519

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CodeMeter versions prior to 7.00

Description: The issue is related to a component of the WebSockets API in the CodeMeter license control application, which is associated with a data source confirmation error. This can be exploited by a remote attacker to gain unauthorized access to modify or create license files for CmActLicense. The vulnerability can be exploited using a specifically crafted JavaScript payload, allowing alteration or creation of license files.

Recommendations: For CodeMeter versions prior to 7.00, consider disabling the WebSockets API as a temporary workaround until a patch is available. For systems or devices where a web browser is used to access a web server and the affected WebSockets API is still enabled, restrict access to the WebSockets API to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2020-04355

CVE-2020-14519

Affected Products

Codemeter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-14519 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14519 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04355 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf · Note
• https://wibu.com/support/security-advisories.html · Note
• https://wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-200521-02.pdf · Note