提交 #229087: ColumbiaSoft Document Locator Authentication Bypass
| 标题 | ColumbiaSoft Document Locator Authentication Bypass |
|---|---|
| 描述 | [Description] The WebTools component of Document Locator allows remote attackers to bypass authentication by redirecting the application SQL login to a remote server to capture the application credentials. [Additional Information] The vulnerability was patched in Document Locator v7.2 SP4 and v2021.1. [VulnerabilityType Other] Authentication Bypass [Vendor of Product] ColumbiaSoft [Affected Component] The vulnerability lies in the Server field in the /api/authentication/login endpoint of the WebTools component. [Attack Vectors] Remote Web Request [Discoverer] Micah Van Deusen and Matt Biedronski |
| 用户 | mvdeusen (UID 57334) |
| 提交 | 2023-10-27 14時54分 (3 年前) |
| 管理 | 2023-10-27 15時53分 (60 minutes later) |
| 状态 | 已接受 |
| VulDB条目 | 243729 [ColumbiaSoft Document Locator 以前 7.2 SP4/2021.1 WebTools login Server 弱身份验证] |
| 积分 | 17 |