CVE-2020-14930

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client.

CVSS v3 8.1 HIGH
CVSS v2.0 4.3 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.exploit-db.com/exploits/48196	Exploit Third Party Advisory VDB Entry
https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-Reset-Authentication-Bypass.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bt_ctroms_terminal_project:bt_ctroms_terminal:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-19 21:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-14930

Mitre link : CVE-2020-14930

CVE.ORG link : CVE-2020-14930

JSON object : View

Products Affected

bt_ctroms_terminal_project

bt_ctroms_terminal

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2020-14930", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2020-06-19T21:15:10.527", "references": [{"url": "https://www.exploit-db.com/exploits/48196", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-Reset-Authentication-Bypass.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client."}, {"lang": "es", "value": "Se detect\u00f3 un problema en BT CTROMS Terminal OS Port Portal CT-464. Una toma de control de la cuenta puede presentarse porque la funcionalidad password-reset revela el token de verificaci\u00f3n. Tras una petici\u00f3n del archivo getverificationcode.jsp, este token se transmite no solo al n\u00famero de tel\u00e9fono registrado de la cuenta de usuario, sino que tambi\u00e9n se transmit\u00eda al cliente HTTP no autenticado"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bt_ctroms_terminal_project:bt_ctroms_terminal:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0289C9D0-7AF8-405A-9EE7-99322F303F91"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}