PT-2021-16726 · Unknown · Testes De Codigo

João Varelas · Published 2021-02-16 · Updated 2023-08-08 · CVE-2021-25648

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Testes de Codigo versions 11.4 and prior

Description The issue allows an attacker to gain access to the administrative interface and premium features by tampering with the boolean value of parameters isAdmin and isPremium located on device storage.

Recommendations For versions 11.4 and prior, consider restricting access to the administrative interface and premium features until a patch is available. As a temporary workaround, avoid using the parameters isAdmin and isPremium or restrict their modification to prevent unauthorized access.

Fix

Related Identifiers

CVE-2021-25648

Affected Products

Testes De Codigo

References · 5

• https://osv.dev/vulnerability/CVE-2021-25648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25648 · Security Note
• https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation · Note
• https://t.me/cvenotify/10346 · Telegram Post
• https://t.me/cibsecurity/23653 · Telegram Post