CVE-2020-14930 · CVEKit

cve.orgen

351 chars

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client.

NVDen

351 chars

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client.

NVDes

397 chars

Se detectó un problema en BT CTROMS Terminal OS Port Portal CT-464. Una toma de control de la cuenta puede presentarse porque la funcionalidad password-reset revela el token de verificación. Tras una petición del archivo getverificationcode.jsp, este token se transmite no solo al número de teléfono registrado de la cuenta de usuario, sino que también se transmitía al cliente HTTP no autenticado

CVSS metrics across sources

2

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N
3.1	Primary	NVD	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H