CVE-2020-10508 - OpenCVE

Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Sun	Ehrd

Configuration 1 [-]

OR	cpe:2.3:a:sun:ehrd:8:::::::*
	cpe:2.3:a:sun:ehrd:9:::::::*

References

Link	Resource
https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: twcert

Published: 2020-03-27T00:00:00

Updated: 2020-03-30T19:25:38

Reserved: 2020-03-12T00:00:00

Link: CVE-2020-10508

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-03-27T08:15:12.960

Modified: 2021-07-21T11:39:23.747

Link: CVE-2020-10508

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "eHRD", "vendor": "Sunnet", "versions": [{"status": "affected", "version": "8"}, {"status": "affected", "version": "9"}]}], "datePublic": "2020-03-27T00:00:00", "descriptions": [{"lang": "en", "value": "Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Sensitive Data Exposure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-30T19:25:38", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71"}], "solutions": [{"lang": "en", "value": "Update to version 10 or latest, or contact Sunnet for fixing patch."}], "source": {"discovery": "UNKNOWN"}, "title": "Sunnet eHRD - Sensitive Data Exposure", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2020-03-27T07:00:00.000Z", "ID": "CVE-2020-10508", "STATE": "PUBLIC", "TITLE": "Sunnet eHRD - Sensitive Data Exposure"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "eHRD", "version": {"version_data": [{"version_affected": "=", "version_value": "8"}, {"version_affected": "=", "version_value": "9"}]}}]}, "vendor_name": "Sunnet"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Sensitive Data Exposure"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html", "refsource": "CONFIRM", "url": "https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html"}, {"name": "https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71", "refsource": "CONFIRM", "url": "https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71"}]}, "solution": [{"lang": "en", "value": "Update to version 10 or latest, or contact Sunnet for fixing patch."}], "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2020-10508", "datePublished": "2020-03-27T00:00:00", "dateReserved": "2020-03-12T00:00:00", "dateUpdated": "2020-03-30T19:25:38", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sun:ehrd:8:*:*:*:*:*:*:*", "matchCriteriaId": "4B27CBB3-B77F-470D-BA69-7CB2AB163B6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sun:ehrd:9:*:*:*:*:*:*:*", "matchCriteriaId": "FD254F84-F0D2-497F-8DDC-4E1DB6958F80", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information."}, {"lang": "es", "value": "Sunnet eHRD, un sistema de gesti\u00f3n de desarrollo y capacitaci\u00f3n humana, almacena inapropiadamente unos archivos de sistema. Los atacantes pueden usar una URL espec\u00edfica y capturar informaci\u00f3n confidencial."}], "id": "CVE-2020-10508", "lastModified": "2021-07-21T11:39:23.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2020-03-27T08:15:12.960", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}