PT-2020-16685
CVE-2020-27408
·
تاريخ النشر
2020-12-04
·
تاريخ التحديث
2021-07-21
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
OpenSIS Community Edition versions through 7.6
Description
The issue is related to incorrect access controls for the file ResetUserInfo.php, allowing an unauthenticated attacker to change the password of arbitrary users.
Recommendations
For OpenSIS Community Edition versions through 7.6, consider restricting access to the ResetUserInfo.php file until a proper fix is applied.
As a temporary workaround, restrict access to the vulnerable file to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾