PT-2018-13139 · Btiteam · Xbtit

Rastating · Publicado 2018-09-05 · Atualizado 2019-10-03 · CVE-2018-15680

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4

Description An issue was discovered where the hashed passwords stored in the xbtit users table are stored as unsalted MD5 hashes. This makes it easier for attackers to obtain cleartext values via a brute-force attack.

Recommendations For BTITeam XBTIT version 2.5.4, consider updating the password storage mechanism to use a salted hashing algorithm to mitigate the risk of brute-force attacks. As a temporary workaround, restrict access to the xbtit users table to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-916

Identificadores relacionados

CVE-2018-15680

Produtos afetados

Xbtit

Referências · 3

• 🔥 https://rastating.github.io/xbtit-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-15680 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15680 · Nota de Segurança