PT-2018-17045 · Docutrac · Office Therapy+2

Publicado 2018-03-19 · Atualizado 2019-10-09 · CVE-2018-5552

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DocuTrac QuicDoc and Office Therapy versions with DTISQLInstaller.exe version 1.6.4.0 and prior

Description The issue concerns a hard-coded cryptographic salt, S@l+&pepper, which is used in the affected software. This could potentially lead to security issues, as hard-coded values can be easily discovered and exploited.

Recommendations For versions with DTISQLInstaller.exe version 1.6.4.0 and prior, consider updating DTISQLInstaller.exe to a version later than 1.6.4.0 to mitigate the risk associated with the hard-coded cryptographic salt.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-760

Identificadores relacionados

CVE-2018-5552

Produtos afetados

Dtisqlinstaller.Exe

Docutrac Quicdoc

Office Therapy

Referências · 3

• 🔥 https://blog.rapid7.com/2018/03/14/r7-2018-01-cve-2018-5551-cve-2018-5552-docutrac-office-therapy-installer-hard-coded-credentials-and-cryptographic-salt · Exploit
• https://osv.dev/vulnerability/CVE-2018-5552 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5552 · Nota de Segurança