PT-2023-11442 · Unknown · Searchblox

Published 2023-09-06 · Updated 2023-09-11 · CVE-2020-10130

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SearchBlox versions prior to 9.1

Description The issue allows a user to bypass business logic and create multiple super admin users in the system. This can be exploited by manipulating the system's user creation mechanism.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the user creation functionality to prevent unauthorized creation of super admin users.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-10130

Affected Products

Searchblox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10130 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10130 · Vendor Advisory
• https://t.me/cibsecurity/70021 · Telegram Post
• https://twitter.com/CVEnew/status/1699500883191517324 · Twitter Post
• https://developer.searchblox.com/v9.2/changelog/version-91 · Note