CVE-2020-27747

An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account.

CVSS v3 6.8 MEDIUM
CVSS v2.0 2.1 LOW

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/jet-pentest/CVE-2020-27747	Third Party Advisory
https://www.clickstudios.com.au/	Product Vendor Advisory
https://github.com/jet-pentest/CVE-2020-27747	Third Party Advisory
https://www.clickstudios.com.au/	Product Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:clickstudios:passwordstate:8.9:build_8973:*:*:*:*:*:*

History

21 Nov 2024, 05:21

Type	Values Removed	Values Added
References	~~() https://github.com/jet-pentest/CVE-2020-27747 - Third Party Advisory~~	() https://github.com/jet-pentest/CVE-2020-27747 - Third Party Advisory
References	~~() https://www.clickstudios.com.au/ - Product, Vendor Advisory~~	() https://www.clickstudios.com.au/ - Product, Vendor Advisory

Information

Published : 2020-10-29 18:15

Updated : 2024-11-21 05:21

NVD link : CVE-2020-27747

Mitre link : CVE-2020-27747

CVE.ORG link : CVE-2020-27747

JSON object : View

Products Affected

clickstudios

passwordstate

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2020-27747", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2020-10-29T18:15:12.613", "references": [{"url": "https://github.com/jet-pentest/CVE-2020-27747", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.clickstudios.com.au/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/jet-pentest/CVE-2020-27747", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.clickstudios.com.au/", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Click Studios Passwordstate versi\u00f3n 8.9 (Build 8973). Si el usuario del sistema se ha asignado a s\u00ed mismo un c\u00f3digo PIN para ingresar desde un dispositivo m\u00f3vil usando el generador incorporado (de 4 d\u00edgitos), un atacante remoto tiene la oportunidad de conducir un ataque de fuerza bruta en este c\u00f3digo PIN. Como resultado, el atacante remoto recupera todas las contrase\u00f1as de otros sistemas, disponibles para una cuenta afectada"}], "lastModified": "2024-11-21T05:21:45.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clickstudios:passwordstate:8.9:build_8973:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10709721-8C56-4A4C-A283-17D521836821"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}