PT-2018-14884 · Comparex · Comparex Miss Marple Enterprise Edition

Marius Schwarz · Publicado 2018-12-20 · Atualizado 2019-01-08 · CVE-2018-19233

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions COMPAREX Miss Marple Enterprise Edition versions prior to 2.0

Description The issue allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Inventory Agent configuration file to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-19233

Produtos afetados

Comparex Miss Marple Enterprise Edition

Referências · 6

• https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19233 · Nota de Segurança
• http://seclists.org/fulldisclosure/2018/Nov/55 · Nota
• http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html · Nota
• https://osv.dev/vulnerability/CVE-2018-19233 · Aviso do Fabricante
• https://seclists.org/bugtraq/2018/Nov/37 · Nota