CVE-2020-9351 — MEDIUM (5.3)

Vulnerability Description

An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the absolute path). NOTE: the documentation states "These tools are, by default, available to anyone ... so they should only be deployed into a trusted environment. Alternately, the tools can easily be restricted to administrators or end users by protecting the tools path with normal authentication and authorization mechanisms on the web server."

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Smartclient	Smartclient	12.0

Related Weaknesses (CWE)

CWE-209

References

https://seclists.org/fulldisclosure/2020/Feb/18ExploitMailing ListThird Party Advisory
https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?
https://seclists.org/fulldisclosure/2020/Feb/18ExploitMailing ListThird Party Advisory
https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?

FAQ

What is CVE-2020-9351?

CVE-2020-9351 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transac...

How severe is CVE-2020-9351?

CVE-2020-9351 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-9351?

Check the references section above for vendor advisories and patch information. Affected products include: Smartclient Smartclient.