CVE-2020-3935

EUVD-2020-25200
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
twcertCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
secomdr.id_access_control
3.3.2
secomdr.id_attendance_system
𝑥
< 3.3.0.3_20160517
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b
https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac
https://www.twcert.org.tw/en/cp-139-3319-d7b65-2.html
https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b
https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac
https://www.twcert.org.tw/en/cp-139-3319-d7b65-2.html