PT-2014-3841 · Ecava · Integraxor

Luigi Auriemma · Publicado 2014-05-01 · Atualizado 2025-10-13 · CVE-2014-0786

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 4.1.4393

Description The issue allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. This is related to an information disclosure vulnerability.

Recommendations For versions prior to 4.1.4393, update to version 4.1.4393 or later to resolve the issue. As a temporary workaround, consider restricting access to the guest role to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-310

CWE-200

Identificadores relacionados

CVE-2014-0786

ZDI-14-117

ZDI-14-369

Produtos afetados

Integraxor

Referências · 8

• https://zerodayinitiative.com/advisories/ZDI-14-369 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-14-117 · Nota de Segurança
• https://t.me/cveNotify/138473 · Publicação no Telegram
• http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-0786 · Nota de Segurança
• http://integraxor.com/blog/category/security/vulnerability-note · Aviso do Fabricante
• https://cisa.gov/news-events/ics-advisories/icsa-14-091-01 · Nota
• https://cisa.gov/news-events/ics-advisories/icsa-14-224-01 · Nota