Vulnerability Report

CVE-2020-36127

Title: Paxtechnology Paxstore Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2020-36127.

CWE Category CWE-295

Published Date May 07, 2021

Modified Date Nov 21, 2024

Exploit Status Not Found

Score 6.5 CVSS v3.1

Exploit Probability (EPSS)

0.14%

Vulnerability Summary

CVE-2020-36127: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be accessed by non-administrator users.

Impacted Vendors

paxtechnology 1

Reference Links

https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/ https://marketing.paxtechnology.com/about-pax https://www.whatspos.com/ https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/ https://marketing.paxtechnology.com/about-pax https://www.whatspos.com/

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:S/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-36127 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

May 07, 2021 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Stack

No specific products linked.