PT-2017-10889 · Cygnux · Syspass

Artem · Publicado 2017-11-17 · Atualizado 2019-10-03 · CVE-2017-1000192

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cygnux sysPass versions 2.1.7 and older

Description The issue allows for Local File Inclusion in the functionality of javascript files inclusion, enabling an attacker to read sensitive information such as configuration files containing database login and password, private encryption key, and other sensitive data.

Recommendations For Cygnux sysPass versions 2.1.7 and older, update to a version newer than 2.1.7 to resolve the issue.

Correção

Identificadores relacionados

CVE-2017-1000192

Produtos afetados

Syspass

Referências · 3

• https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000192 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000192 · Nota de Segurança