PT-2021-18587 · Mk-Auth · Mk-Auth

Alacerda + 3 · Published 2021-01-03 · Updated 2021-01-07 · CVE-2021-3005

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MK-AUTH versions through 19.01 K4.9

Description The issue allows remote attackers to obtain sensitive information, such as a CPF number, by modifying the titulo (also known as invoice number) value in the "central/recibo.php" URI.

Recommendations For MK-AUTH versions through 19.01 K4.9, as a temporary workaround, consider restricting access to the "central/recibo.php" URI until a patch is available. Avoid using modified titulo values in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-3005

Affected Products

Mk-Auth

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-3005 · Security Note
• http://mk-auth.com.br · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3005 · Vendor Advisory
• https://gist.github.com/alacerda/3b925cb333eb839ae808d6f01642aeb3 · Note
• https://t.me/cibsecurity/21515 · Telegram Post
• https://t.me/cvenotify/8113 · Telegram Post