CVE-2019-11488

Опубликовано: 25 апр. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history.

Ссылки

https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack/
Exploit
Third Party Advisory
https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf
Exploit
Technical Description
Third Party Advisory
https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack/
Exploit
Third Party Advisory
https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:simplybook:simplybook:*:*:*:*:enterprise:*:*:*

Версия до 2019-04-23 (исключая)

EPSS

Процентиль: 69%

0.00598

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-hfhv-wm6q-v6xc