PT-2017-14351 · Nq · Nq Contacts Backup & Restore

Publicado 2017-10-29 · Atualizado 2019-10-03 · CVE-2017-15999

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NQ Contacts Backup & Restore version 1.1

Description The application transmits login and synced user data without using HTTPS. During login, the username is sent in cleartext along with an SHA-1 hash of the password. This allows an attacker to either crack the hash or use it for further attacks where only the hash value is required.

Recommendations For version 1.1, consider disabling the login functionality until a secure version of the application is available, and avoid using the application for sensitive data transmission. Restrict access to the application's data to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-15999

Produtos afetados

Nq Contacts Backup & Restore

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-15999 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15999 · Nota de Segurança
• https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html · Nota