PT-2021-11865 · Tinycheck · Tinycheck

Published 2021-01-19 · Updated 2021-01-29 · CVE-2020-35929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TinyCheck versions before commit 9fd360d and ea53de8

Description: The installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data.

Recommendations: For versions before commit 9fd360d and ea53de8, update to a version that includes commits 9fd360d and ea53de8 to remove the hard-coded credentials. As a temporary workaround, consider restricting access to the backend part of the tool until a secure version is installed.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-35929

GHSA-9F7G-72H2-59G7

Affected Products

Tinycheck

References · 5

• https://osv.dev/vulnerability/CVE-2020-35929 · Vendor Advisory
• ❌ https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-9f7g-72h2-59g7 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2020-35929 · Security Note
• https://t.me/cvenotify/8704 · Telegram Post
• https://t.me/cibsecurity/22294 · Telegram Post