PT-2021-8564 · Unknown · Sapphireims

Tanoy Bose · Published 2021-08-11 · Updated 2021-08-16 · CVE-2017-16630

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SapphireIMS version 4097 1

Description The issue allows a guest user to create a local administrator account on any system with SapphireIMS installed due to an Insecure Direct Object Reference (IDOR) in the local user creation function. This means that the function does not properly restrict access to objects, allowing unauthorized users to perform actions they should not be able to.

Recommendations For SapphireIMS version 4097 1, consider restricting access to the local user creation function to prevent guest users from creating local administrator accounts until a patch is available. As a temporary workaround, limit the privileges of guest users to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-16630

Affected Products

Sapphireims

References · 5

• https://osv.dev/vulnerability/CVE-2017-16630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16630 · Security Note
• https://t.me/cibsecurity/27193 · Telegram Post
• https://vuln.shellcoder.party/tags/sapphireims · Note
• https://vuln.shellcoder.party/2020/07/18/cve-2017-16630-sapphireims-idor-based-privilege-elevation · Note