PT-2021-12820 · Iportalis · Iportalis Ics

Published 2021-09-01 · Updated 2021-09-09 · CVE-2020-9002

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: iPortalis iCS version 7.1.13.0

Description: An issue allows an attacker to gain privileges by intercepting a request and modifying the UserRoleKey from COMPANY ADMIN to DOMAIN ADMIN to achieve Domain Administrator access.

Recommendations: For iPortalis iCS version 7.1.13.0, consider restricting access to requests that contain the UserRoleKey parameter to minimize the risk of exploitation. As a temporary workaround, monitor and validate all requests that attempt to change the UserRoleKey to DOMAIN ADMIN. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-9002

Affected Products

Iportalis Ics

References · 7

• https://osv.dev/vulnerability/CVE-2020-9002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9002 · Security Note
• https://t.me/cvenotify/20494 · Telegram Post
• https://t.me/cvenotify/20563 · Telegram Post
• https://websec.nl/blog · Note
• https://t.me/cibsecurity/28150 · Telegram Post
• https://websec.nl/blog/6127847280e759c7d31286d0/cve%20report%20august%202021 · Note