PT-2020-7075 · Unknown · Obs-Server

Published 2020-01-02 · Updated 2020-01-14 · CVE-2010-3782

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions obs-server versions prior to 1.7.7

Description The issue allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.

Recommendations For versions prior to 1.7.7, update to version 1.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API until the update is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2010-3782

Affected Products

Obs-Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-3782 · Security Note
• https://t.me/cibsecurity/8971 · Telegram Post
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00001.html · Note