VulnerabilityModified
CVE-2020-13963
The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).
CRITICAL 9.8EPSS 1.81%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- soplanning/soplanning
- Source
- cve@mitre.org
References
- https://cwe.mitre.org/data/definitions/321.htmlTechnical Description
- https://forum.soplanning.org/viewforum.php?f=8Vendor Advisory
- https://labs.integrity.pt/advisories/cve-2020-13963/Third Party Advisory
- https://cwe.mitre.org/data/definitions/321.htmlTechnical Description
- https://forum.soplanning.org/viewforum.php?f=8Vendor Advisory
- https://labs.integrity.pt/advisories/cve-2020-13963/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.