PT-2022-3296 · Trueconf · Trueconf Server

Liquidworm · Published 2022-06-29 · Updated 2023-04-20 · CVE-2017-20119

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TrueConf Server version 4.3.7

Description A problematic vulnerability has been found in TrueConf Server, affecting an unknown part of the file /admin/general/change-lang. The manipulation of the redirect url argument leads to an open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability allows a remote attacker to redirect users to an arbitrary URL.

Recommendations For TrueConf Server version 4.3.7, consider disabling the /admin/general/change-lang endpoint or restricting access to it until a patch is available. Avoid using the redirect url argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2022-04034

CVE-2017-20119

Affected Products

Trueconf Server

References · 7

• 🔥 https://exploit-db.com/exploits/41184 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-20119 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04034 · Security Note
• https://t.me/cvenotify/48750 · Telegram Post
• https://vuldb.com/?id.96633 · Note
• https://t.me/cibsecurity/45369 · Telegram Post