by Kastro
Paper/Archive/CVE-2020-13963

CVE-2020-13963

mitre — SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.6.786 × 2015.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refforum.soplanning.org/viewforum.php?f=8reflabs.integrity.pt/advisories/cve-2020-13963refcwe.mitre.org/data/definitions/321.html