title: SecureGate authentication bypass vulnerability
description: This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.
problem types: CWE-288 Authentication Bypass Using an Alternate Path or Channel
affected:
{
platforms: Windows
product: SecureGate
vendor: HANSSAK Co.,Ltd
versions:
status: affected, version: 3.5
}
{
platforms: Windows
product: WebLink
vendor: HANSSAK Co.,Ltd
versions:
lessThanOrEqual: 3.5.5, status: affected, version: 3.5.2, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]