CVE-2020-3935 : TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.

Published 2020-02-11 12:15:21

Updated 2021-12-22 17:57:50

Source TWCERT/CC

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-3935

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3935

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	TWCERT/CC
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2020-3935

https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b

Dr.ID SQL Injection and Information exposure · GitHub
Third Party Advisory

CVEs referencing this url
https://www.twcert.org.tw/en/cp-139-3319-d7b65-2.html

TWCERT/CC Taiwan Computer Emergency Response Team/Coordination Center-Services-Taiwan Vulnerability Note (TVN)-TVN List-TAIWAN SECOM CO., LTD. - Sensitivity Information Exposure
Third Party Advisory
https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac

CVE-2020-3933-3935｜中華資安國際 CHT Security Co., Ltd.
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-3935

Secom » Dr.id Access Control » Version: 3.3.2
cpe:2.3:a:secom:dr.id_access_control:3.3.2:*:*:*:*:*:*:*
Matching versions
Secom » Dr.id Attendance System
Versions before (<) 3.3.0.3_20160517
cpe:2.3:a:secom:dr.id_attendance_system:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-3935

Exploit prediction scoring system (EPSS) score for CVE-2020-3935

CVSS scores for CVE-2020-3935

CWE ids for CVE-2020-3935

References for CVE-2020-3935

Products affected by CVE-2020-3935