PT-2017-14112 · Writediary · Diary With Lock

Publicado 2017-10-27 · Atualizado 2019-10-03 · CVE-2017-15581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Diary with lock (aka WriteDiary) version 4.72

Description The issue concerns the transmission of data without encryption in the Diary with lock application, which is intended for storing personal and sensitive information. This lack of encryption allows remote attackers to obtain sensitive information by sniffing the network during the execution of certain activities, such as LoginActivity or NoteActivity.

Recommendations For version 4.72, consider disabling the transmission of sensitive data over unencrypted connections as a temporary workaround until a patch is available that implements proper encryption, such as HTTPS, for data transmission. Restrict access to sensitive features like LoginActivity and NoteActivity to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2017-15581

Produtos afetados

Diary With Lock

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-15581 · Nota de Segurança
• https://gist.github.com/anonymous/603b89f864a71426042b167cab557efa · Nota
• https://1337sec.blogspot.de/2017/10/auditing-writediarycom-cve-2017-15581.html · Nota
• https://osv.dev/vulnerability/CVE-2017-15581 · Aviso do Fabricante