PT-2021-8976 · Comelit · App Lejos De Casa

Published 2021-08-03 · Updated 2021-08-11 · CVE-2019-14453

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Comelit "App lejos de casa (web)" version 2.8.0

Description The issue allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. An attacker can achieve high privileges, such as installer or administrator, for the graphical interface by using a specific value, 1C000000000S, for domus in conjunction with a zero value for logged.

Recommendations For Comelit "App lejos de casa (web)" version 2.8.0, consider restricting access to the js/bridge.min.js and login.json files to minimize the risk of exploitation. As a temporary workaround, avoid using modified domus and logged fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-14453

Affected Products

App Lejos De Casa

References · 3

• 🔥 https://blogx86.net/2021/07/26/cve-2019-14453 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14453 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14453 · Vendor Advisory