CentralSquare Community Development Authentication Bypass Vulnerability in IVR Administrative Interface

A vulnerability allowing authentication bypass has been identified in the CentralSquare Community Development platform, specifically in version 19.5.7. This issue allows unauthorized access to the administrative panel of the IVR (Interactive Voice Response) component, which is used for managing permit records and inspections. The vulnerability arises from insufficient access control, enabling attackers to access administrative features without valid credentials.

Impact

Exploitation of this vulnerability allows unauthorized users to access and modify the IVR administrative interface. This includes the ability to change IVR configurations, upload custom voice files, and alter system operations without authentication.

Remediation

CentralSquare has indicated that it will contact affected organizations with guidance on updates. In the meantime, it is recommended to restrict public access to the IVR web interface, limit access to internal networks or VPNs, and monitor access logs for unusual activity related to the IVR administrative page.