PT-2024-71: Predictable format of user identifiers in Password Pusher

HIGH
(8.8) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
THREATSCAPE

Analytics articles

What are the security threats on your network?

Check your traffic-for free
Request pilot

Vulnerability type:

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  • Severity (CVSSv3.1): 8.6 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
  • Severity (CVSSv4.0): 8.8 (high)

Description:

The vulnerability was identified in Password Pusher versions prior to 1.48.0.

Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 04.11.2024

Recommendations:

Additional information: Positive Technologies

Vendor:
Apnotic, LLC
Vulnerable product:
Password Pusher
Vulnerable version:
< 1.48.0

Get in touch

Fill in the form and our specialists
will contact you shortly