CVE-2020-36127

Katalog CVE

CVSS 6.5 · Medium EPSS 0,68%

Kerentanan Improper Certificate Validation pada paxtechnology paxstore. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be accessed by non-administrator users.

Rincian

Terbit di NVD

7 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/ exploit · advisory pihak ketiga
• https://marketing.paxtechnology.com/about-pax product
• https://www.whatspos.com/ product