CVE-2020-8434 Hardcoded credentials in n/a
Attackers can impersonate any user by generating valid session cookies using a hard-coded key, bypassing authentication and MFA in Jenzabar JICS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8434?
CVE-2020-8434 is a critical vulnerability in n/a, published on 19 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
Weakness: CWE-384
Which versions are affected by CVE-2020-8434?
It affects 1 product.
Products include Jenzabar Internet Campus Solution.
How do I fix CVE-2020-8434?
No fix has been published for CVE-2020-8434 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8434 being exploited?
There is no known exploitation of CVE-2020-8434 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xxqg-cq6p-jpqq.