CVE-2010-1910

The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields.

CVSS v2.0 5.1 MEDIUM

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf	Patch Vendor Advisory
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.securityfocus.com/bid/40003
http://secunia.com/advisories/39740	Vendor Advisory
http://www.kb.cert.org/vuls/id/602801	Patch US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:consona:consona_dynamic_agent:-:-:marketing:::::*
	cpe:2.3:a:consona:consona_dynamic_agent:-:-:support:::::*
	cpe:2.3:a:consona:consona_dynamic_agent:-:-:enterprise:::::*
	cpe:2.3:a:consona:consona_live_assistance::::::::
	cpe:2.3:a:consona:consona_subscriber_assistance::::::::

Information

Published : 2010-05-12 04:46

Updated : 2018-10-10 12:57

NVD link : CVE-2010-1910

Mitre link : CVE-2010-1910

JSON object : View

CWE

CWE-287

Improper Authentication

Advertisement

Products Affected

consona

consona_live_assistance
consona_dynamic_agent
consona_subscriber_assistance

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf", "name": "http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html", "name": "http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/40003", "name": "40003", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/39740", "name": "39740", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.kb.cert.org/vuls/id/602801", "name": "VU#602801", "tags": ["Patch", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/archive/1/511176/100/0/threaded", "name": "20100507 [Wintercore Research] Consona Products - Multiple vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-287"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-1910", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-05-12T11:46Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:consona:consona_dynamic_agent:-:-:marketing:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:consona:consona_dynamic_agent:-:-:support:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:consona:consona_dynamic_agent:-:-:enterprise:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:consona:consona_live_assistance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:consona:consona_subscriber_assistance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-10T19:57Z"}