PT-2017-14282 · Sera · Sera

Mark Wadham · Publicado 2017-11-01 · Atualizado 2019-10-03 · CVE-2017-15918

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sera version 1.2

Description The issue allows for trivial privilege escalation and exposes user and system keychains to local attacks because it stores the user's login password in plain text in their home directory.

Recommendations For Sera version 1.2, consider removing or securing the plain text password storage to prevent local attacks and privilege escalation. As a temporary workaround, restrict access to the home directory where the password is stored to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2017-15918

Produtos afetados

Sera

Referências · 4

• 🔥 https://m4.rkw.io/blog/cve201715918-sera-12-local-root-privesc-and-password-disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/43221 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15918 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15918 · Nota de Segurança