PT-2023-11496 · Cmseasy · Cmseasy

Godepic · Published 2023-06-27 · Updated 2023-07-05 · CVE-2020-18406

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cmseasy version 7.0.0

Description An issue was discovered that allows user credentials to be sent in clear text due to no encryption of form data.

Recommendations For cmseasy version 7.0.0, consider implementing encryption for form data to prevent user credentials from being sent in clear text. As a temporary workaround, restrict access to sensitive areas of the application until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-18406

Affected Products

Cmseasy

References · 4

• 🔥 https://github.com/source-hunter/cmseasy/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-18406 · Security Note
• https://osv.dev/vulnerability/CVE-2020-18406 · Vendor Advisory
• https://t.me/cvenotify/53665 · Telegram Post