PT-2020-20: Race condition privilege escalation (secins application RBAC bypass)

HIGH
(8.8) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerable software

Verifone
MX900

Severity level

Severity level: High
Impact: Race condition privilege escalation (secins application RBAC bypass)
Access Vector: Local

CVSS v3.1:
Base Score: 8.8
Vector: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVE-2019-14711

Advisory status

01.10.2019 - Vendor gets vulnerability details
01.08.2020 - Vendor releases fixed version and details

Credits

The vulnerability was detected by Alex Stennikov, Dmitry Sklyarov, Egor Zaitsev, Positive Research Center (Positive Technologies Company)

Get in touch

Fill in the form and our specialists
will contact you shortly