PT-2017-14349 · Nq · Nq Contacts Backup & Restore

Publicado 2017-10-29 · Atualizado 2019-10-03 · CVE-2017-15997

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NQ Contacts Backup & Restore version 1.1

Description The issue concerns the use of a static RC4 key for encryption in the application, which can allow an attacker to more easily gain access to user credentials by accessing the preferences XML file. This affects the security of user passwords stored locally.

Recommendations For version 1.1, consider disabling the use of RC4 encryption until a more secure encryption method can be implemented, or restrict access to the preferences XML file to minimize the risk of exploitation.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2017-15997

Produtos afetados

Nq Contacts Backup & Restore

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-15997 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15997 · Aviso do Fabricante
• https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html · Nota