PT-2020-9368 · Unknown · Bond Jetselect

Published 2020-05-14 · Updated 2021-07-21 · CVE-2019-13023

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bond JetSelect (affected versions not specified)

Description: An issue was discovered in Bond JetSelect where the web interface uses HTML 'password field' obfuscation to hide RADIUS secrets, WPA passwords, and SNMP strings from non-administrative users. However, it is possible to change this obfuscation using Developer tools, making the credentials visible.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

CVE-2019-13023

Affected Products

Bond Jetselect

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13023 · Security Note
• https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application · Note
• https://t.me/cibsecurity/12074 · Telegram Post