critical9.8
CVE-2018-9031
The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code.
Impact
The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tnlsoftsolutions | Sentry Vision | Versions 3.0, 3.1, 3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh
- https://www.youtube.com/watch?v=pLMH9vGPRCo
- https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh
- https://www.youtube.com/watch?v=pLMH9vGPRCo