PT-2017-7736 · Hitek · Automize

Publicado 2017-01-23 · Atualizado 2017-03-16 · CVE-2016-10103

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitek Software's Automize versions 10.0 through 10.25 Hitek Software's Automize versions 11.0 through 11.14

Description The issue allows an attacker to recover encrypted passwords for GPG Encryption profiles due to the Read attribute being set for Users in encryptionProfiles.jsd. This can lead to Information Disclosure.

Recommendations For versions 10.0 through 10.25, consider restricting access to the encryptionProfiles.jsd file to prevent unauthorized reading of encrypted passwords. For versions 11.0 through 11.14, consider restricting access to the encryptionProfiles.jsd file to prevent unauthorized reading of encrypted passwords. As a temporary workaround, consider disabling the GPG Encryption profiles until a patch is available.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-255

Identificadores relacionados

CVE-2016-10103

Produtos afetados

Automize

Referências · 4

• https://rastamouse.me/guff/2016/automize · Nota
• https://osv.dev/vulnerability/CVE-2016-10103 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10103 · Nota de Segurança
• http://securityfocus.com/bid/96850 · Nota