Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure.

Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure.

The application suffers from username disclosure via its username reset functionality. An attacker can enumerate and disclose all the valid users on the system. Furthermore, when calling a certain page from a remote location, the following internal information can be divulged for the current system: Name, Internal IP Address, Netmask, Hostname, Gateway, DNS Server, and DNS Server 2.CVE-2019-7272 and CVE-2019-7277 have been assigned to these vulnerabilities. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The affected application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious website.CVE-2019-7273 has been assigned to this vulnerability. A CVSS v3 base score of 5.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists due to the absence of file extension validation when uploading files through the badge image upload script. A remote and unauthenticated attacker can upload files with arbitrary extensions into a directory within application 's web root and execute them with privileges of the web server.CVE-2019-7274 has been assigned to this vulnerability. A CVSS v3 base score of 9.9 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).…