CVE-2010-1910

Consona Dynamic Agent - Authentication Bypass

Title source: rule

Description

The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields.

References (6)

[Vendor Advisory] http://secunia.com/advisories/39740

[Various Sources] http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html

[Patch, Vendor Advisory] http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf

[Patch, US Government Resource] http://www.kb.cert.org/vuls/id/602801

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/511176/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/40003

Scores

EPSS 0.0110

EPSS Percentile 77.8%

Classification

CWE

CWE-287

Status draft

Affected Products (5)

consona/consona_dynamic_agent

consona/consona_dynamic_agent

consona/consona_dynamic_agent

consona/consona_live_assistance

consona/consona_subscriber_assistance

Timeline

Published May 12, 2010

Tracked Since Feb 18, 2026