PT-2002-3013 · Lawson · Lawson Financials

Publicado 2002-12-31 · Atualizado 2017-07-29 · CVE-2002-2301

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Lawson Financials version 8.0

Description: The issue concerns the storage of usernames and passwords in a world-readable file when Lawson Financials is configured to use a third-party relational database. This allows local users to read the passwords and log onto the database.

Recommendations: For Lawson Financials version 8.0, consider restricting access to the file that stores usernames and passwords to prevent local users from reading the passwords and logging onto the database. As a temporary workaround, limit the use of third-party relational databases until a more secure configuration or update is available.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2002-2301

Produtos afetados

Lawson Financials

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/10742 · Nota
• http://seclists.org/lists/bugtraq/2002/Dec/0012.html · Nota
• http://securityfocus.com/bid/6293 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2301 · Nota de Segurança