PT-2018-13140 · Btiteam · Xbtit

Rastating · Publicado 2018-09-05 · Atualizado 2019-10-03 · CVE-2018-15681

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4

Description An issue was discovered where the password hash of a user is rehashed using a predictable salt and stored in the pass cookie, which is not flagged as HTTPOnly. This allows an attacker who steals the cookie to efficiently brute-force it and retrieve the user's cleartext password.

Recommendations For BTITeam XBTIT version 2.5.4, consider disabling the storage of password hashes in the pass cookie until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using predictable salts for password hashing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Enumeração de Fraquezas

CWE-732

CWE-916

Identificadores relacionados

CVE-2018-15681

Produtos afetados

Xbtit

Referências · 3

• 🔥 https://rastating.github.io/xbtit-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15681 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15681 · Aviso do Fabricante