PT-2021-8565 · Unknown · Sapphireims

Tanoy Bose · Published 2021-08-11 · Updated 2021-08-16 · CVE-2017-16631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SapphireIMS version 4097 1

Description The issue allows a guest user to change the password of an administrative user by exploiting an Insecure Direct Object Reference (IDOR) in the "Account Password Reset" functionality.

Recommendations For SapphireIMS version 4097 1, restrict access to the "Account Password Reset" functionality to prevent unauthorized password changes until a fix is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-16631

Affected Products

Sapphireims

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-16631 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16631 · Vendor Advisory
• https://vuln.shellcoder.party/tags/sapphireims · Note
• https://vuln.shellcoder.party/2020/07/18/cve-2017-16631-sapphireims-idor-on-password-reset · Note