PT-2017-14025 · Thornberry · Ndoc

Greg Ramey · Publicado 2017-10-26 · Atualizado 2019-10-03 · CVE-2017-15366

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thornberry NDoc versions prior to 8.0

Description The issue concerns a default database user password that is stored in cleartext in a log file during client installation on laptops. This password can be used to gain full admin or system access to client devices, if no firewall is present, or to the NDoc server itself. An attacker who obtains this password can access the system without requiring local access.

Recommendations For Thornberry NDoc versions prior to 8.0, change the default database user password to a unique and secure password to prevent unauthorized access. Consider implementing a firewall to restrict access to client devices and the NDoc server. As a temporary workaround, restrict access to the log file containing the cleartext password to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-15366

Produtos afetados

Ndoc

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-15366 · Aviso do Fabricante
• https://gist.github.com/emptythevoid/84248daccce8737f1cdd5b395cf6f32c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15366 · Nota de Segurança