Geocall v6.3 Vulnerability Advisory: XSS, Directory Traversal, Auth Bypass (CVE-2019-5888-5891)

Critical Vulnerability Information Incorrect Access Control CVE: CVE-2019-5891 Affected Products and Versions: Geocall – v. 6.3 (Build < 2:346977) Summary: A critical vulnerability was discovered in Geocall v.6.3, allowing unauthenticated attackers to obtain authenticated users' cookies and log in to the web application. Remediation: Upgrade to Build 2:346977. Insecure Permissions CVE: CVE-2019-5890 Affected Products and Versions: Geocall – v. 6.3 (Build < 2:346977) Summary: A critical vulnerability was discovered in Geocall v.6.3, where weak authentication and session management allow authenticated users to access the administration control panel and perform administrative functions. Remediation: Upgrade to Build 2:346977. Cross-Site Scripting (XSS) CVE: CVE-2019-5888 Affected Products and Versions: Geocall – v. 6.3 (Build < 2:346977) Summary: Multiple reflected and stored XSS vulnerabilities were discovered in Geocall v.6.3. Remediation: Upgrade to Build 2:346977. Directory Traversal CVE: CVE-2019-5889 Affected Products and Versions: Geocall – v. 6.3 (Build < 2:346977) Summary: A directory traversal vulnerability was discovered in the log management feature of Geocall v.6.3. Remediation: Upgrade to Build 2:346977. Timeline: 2018/10/23 – Initial contact with vendor 2018/10/23 – Vendor acknowledged and agreed to discuss the issue and coordinate disclosure 2019/01/08 – Vendor released patched version Discoverer: Claudio Cinquino References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=related-CVE-ID

Goal Reached Thanks to every supporter — we hit 100%!

Geocall v6.3 Vulnerability Advisory: XSS, Directory Traversal, Auth Bypass (CVE-2019-5888-5891)