Vulnerability Description
An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bt Ctroms Terminal Project | Bt Ctroms Terminal | - |
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/48196ExploitThird Party AdvisoryVDB Entry
- https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-ReseExploitThird Party Advisory
- https://www.exploit-db.com/exploits/48196ExploitThird Party AdvisoryVDB Entry
- https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-ReseExploitThird Party Advisory
FAQ
What is CVE-2020-14930?
CVE-2020-14930 is a vulnerability with a CVSS score of 8.1 (HIGH). An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp requ...
How severe is CVE-2020-14930?
CVE-2020-14930 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-14930?
Check the references section above for vendor advisories and patch information. Affected products include: Bt Ctroms Terminal Project Bt Ctroms Terminal.