Pleasant Password Server up to 7.8.2 Authorization Attachment improper authorization

Summaryinfo

A vulnerability described as critical has been identified in Pleasant Password Server up to 7.8.2. This affects an unknown part of the component Authorization. Executing a manipulation as part of Attachment can lead to improper authorization. The identification of this vulnerability is CVE-2017-17707. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Pleasant Password Server up to 7.8.2. It has been declared as critical. This vulnerability affects an unknown code block of the component Authorization. The manipulation as part of a Attachment leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely identifies a password safe entry. Since "CredentialId" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.

The bug was discovered 06/22/2018. The weakness was shared 07/31/2018 (Website). The advisory is shared for download at profundis-labs.com. This vulnerability was named CVE-2017-17707 since 12/14/2017. The exploitation appears to be easy. The attack can be initiated remotely. The requirement for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

The vulnerability was handled as a non-public zero-day exploit for at least 39 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 7.8.3 eliminates this vulnerability.

The entry VDB-122345 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Pleasant

Name

• Password Server

Version

• 7.8.0
• 7.8.1
• 7.8.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion