PT-2022-11693 · Veridium · Veridiumid Veridiumad

Philipp Mao · Published 2022-01-28 · Updated 2022-02-02 · CVE-2021-42791

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions VeridiumID VeridiumAD version 2.5.3.0

Description An issue was discovered in the HTTP request that triggers push notifications for enrolled users, where proper access control is not enforced. This allows a user to trigger push notifications for any other user and modify the text contained in the notification. If the recipient accepts the notification, the user who triggered it can obtain the recipient's login certificate.

Recommendations For VeridiumID VeridiumAD version 2.5.3.0, consider disabling the push notification feature until a patch is available to enforce proper access control and prevent unauthorized modifications to notification text. Restrict access to the HTTP request endpoint that triggers push notifications to minimize the risk of exploitation. Avoid using the feature that allows triggering push notifications for other users until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-42791

Affected Products

Veridiumid Veridiumad

References · 7

• https://veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft-active-directory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42791 · Security Note
• https://t.me/cibsecurity/36456 · Telegram Post
• https://compass-security.com/en/research/advisories · Note
• https://compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_Control.txt · Note
• https://t.me/cvenotify/25967 · Telegram Post