Skip to content

Latest commit

 

History

History
30 lines (20 loc) · 777 Bytes

VS-2018-010.md

File metadata and controls

30 lines (20 loc) · 777 Bytes

[VS-2018-010] AccuPOS Incorrect Permission Assignment for Critical Resource

CVE ID

CVE-2018-15809

CVSS Score

Pending

Vendor

AccuPOS, Inc.

Product

AccuPOS

Vulnerability Details

The AccuPOS Point Of Sale Application is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. This may allow local attackers to compromise the integrity of critical resource and executable files.

Vendor Response

AccuPOS has not remediated the vulnerability.

Disclosure Timeline

  • 02-27-2018 - Disclosed to Vendor
  • 03-27-2018 - Follow up via Email
  • 04-09-2018 - No response from vendor
  • 06-03-2018 - Publicly disclosed at BSides ATL

Credit

VerSprite Security Research Team