Possible Account Takeover | Brute Force Ability# CVE-2020-27747
Possible Account Takeover | Brute Force Ability
[Suggested description]
An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).
If the user of the system has assigned himself a PIN code for entering
from a mobile device using the built-in generator (4 digits), a remote
attacker has the opportunity to conduct a brute force attack on this
PIN code.
------------------------------------------
[Additional Information]
A letter was sent to the vendor about the vulnerability.
------------------------------------------
[VulnerabilityType Other]
CWE-307: Improper Restriction of Excessive Authentication Attempts
------------------------------------------
[Vendor of Product]
Click Studios (https://www.clickstudios.com.au/)
------------------------------------------
[Affected Product Code Base]
Affected version: Passwordstate 8.9 (Build 8973). There are no fixed versions
------------------------------------------
[Affected Component]
Mobile login page
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
If the user of the system has assigned himself a PIN code for entering
from a mobile device using the built-in generator (4 digits), a remote
attacker has the opportunity to conduct a brute force attack on this
PIN code.
------------------------------------------
[Discoverer]
Dmitry Kuramin (Jet Infosystems, jet.su)
------------------------------------------
[Reference]
https://jet.su
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view