PT-2022-10754 · Softvibe · Softvibe Saraban For Infoma

Published 2022-01-18 · Updated 2024-02-14 · CVE-2021-38696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftVibe SARABAN for INFOMA version 1.1

Description The issue allows attackers to access signature files on the application without any authentication due to incorrect access control.

Recommendations For SoftVibe SARABAN for INFOMA version 1.1, consider restricting access to the signature files until a proper authentication mechanism is implemented to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-38696

Affected Products

Softvibe Saraban For Infoma

References · 8

• 🔥 https://orangeo.tech/post/2021/12/24/First-CVEs.html · Exploit
• 🔥 https://sawatdee.github.io/post/2021/12/24/First-CVEs.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-38696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38696 · Security Note
• https://t.me/cibsecurity/35704 · Telegram Post
• https://t.me/cvenotify/25587 · Telegram Post
• http://infoma.net/index.php/saraban · Note
• https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US · Note