PT-2021-11523 · Unknown · Star Practice Management Web

Published 2021-01-29 · Updated 2021-07-21 · CVE-2020-28405

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Star Practice Management Web version 2019.2.0.6

Description: An issue exists where improper authorization allows an unauthorized user to modify user privileges within the application. This can lead to the unauthorized user granting themselves administrative access or removing all administrative accounts.

Recommendations: For version 2019.2.0.6, consider restricting access to user management functions until a fix is available. As a temporary workaround, closely monitor user account changes and administrative access to minimize potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-28405

Affected Products

Star Practice Management Web

References · 5

• https://osv.dev/vulnerability/CVE-2020-28405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28405 · Security Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28405 · Note
• https://starpracticemanagement.com · Note
• https://excellium-services.com/cert-xlm-advisory/CVE-2020-28405 · Note