PT-2024-28459 · Entrust · Entrust Instant Financial Issuance

Omar A. Crespo + 1 · Published 2024-09-23 · Updated 2024-11-04 · CVE-2024-39341

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Entrust Instant Financial Issuance (On Premise) Software versions 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier

Description The issue concerns a configuration file, specifically WebAPI.cfg.xml, which is left behind after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It contains system configuration parameter names and values, including sensitive configuration values that are encrypted.

Recommendations For versions 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier, consider restricting access to the WebAPI.cfg.xml file to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the HTTP port 80 to minimize the risk of exploitation. Avoid using guessable IIS webroot paths for sensitive configuration files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-39341

Affected Products

Entrust Instant Financial Issuance

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-39341 · Security Note
• https://twitter.com/CVEnew/status/1838282439208096118 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838326851195773376 · Twitter Post
• https://trustedcare.entrust.com/login · Note
• https://gist.github.com/VAMorales/21a8700a67d80c263b38e693fd528313 · Note
• https://entrust.com · Note
• https://t.me/cvedetector/6199 · Telegram Post
• https://t.me/cvedetector/6200 · Telegram Post