PT-2021-9684 · Unknown · Soplanning

Bruno Morisson + 1 · Published 2021-03-21 · Updated 2022-11-05 · CVE-2020-13963

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.47

Description The issue is related to incorrect access control due to public secret key information and its related authentication algorithm. Specifically, the key for the admin account is hardcoded in the installation code, and there is no key for the publicsp guest account.

Recommendations For versions prior to 1.47, update to version 1.47 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin account and publicsp guest account until the update is applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-13963

Affected Products

Soplanning

References · 8

• https://forum.soplanning.org/viewforum.php?f=8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13963 · Security Note
• https://t.me/cvenotify/11685 · Telegram Post
• https://t.me/cibsecurity/25217 · Telegram Post
• https://labs.integrity.pt/advisories/cve-2020-13963 · Note
• https://cwe.mitre.org/data/definitions/321.html · Note
• https://t.me/cvenotify/11991 · Telegram Post