PT-2023-10347 · Icepay · Icepay Rest-Api-Net

Published 2023-03-12 · Updated 2024-05-17 · CVE-2016-15028

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ICEPAY REST-API-NET version 0.9

Description A vulnerability was found in the function RestClient of the file Classes/RestClient.cs of the component Checksum Validation. The manipulation leads to improper validation of integrity check value. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0 is able to address this issue.

Recommendations For ICEPAY REST-API-NET version 0.9, upgrade to version 1.0 to address the issue. As a temporary workaround, consider disabling the RestClient function until the patch is applied. Restrict access to the Checksum Validation component to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2016-15028

Affected Products

Icepay Rest-Api-Net

References · 9

• https://github.com/ICEPAY/REST-API-NET/commit/61f6b8758e5c971abff5f901cfa9f231052b775f · Patch
• https://github.com/ICEPAY/REST-API-NET/releases/tag/1.0 · Patch
• https://osv.dev/vulnerability/CVE-2016-15028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15028 · Security Note
• https://vuldb.com/?ctiid.222847 · Note
• https://t.me/cibsecurity/59877 · Telegram Post
• https://t.me/cvenotify/46402 · Telegram Post
• https://t.me/cvenotify/46081 · Telegram Post
• https://vuldb.com/?id.222847 · Note