Описание
In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.)
Ссылки
- Third Party AdvisoryVDB Entry
- Product
- Third Party AdvisoryVDB Entry
- Product
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:ebankit:ebankit:6:*:*:*:*:*:*:*
EPSS
Процентиль: 20%
0.00063
Низкий
7.4 High
CVSS3
Дефекты
CWE-276
CWE-276
Связанные уязвимости
CVSS3: 7.4
github
больше 2 лет назад
In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.)
EPSS
Процентиль: 20%
0.00063
Низкий
7.4 High
CVSS3
Дефекты
CWE-276
CWE-276