PT-2023-14612 · Wellintech · Kinghistorian

Carl Hurd · Publicado 2023-03-20 · Atualizado 2023-07-07 · CVE-2022-45124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WellinTech KingHistorian version 35.01.00.05

Description An information disclosure issue exists in the User authentication functionality. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can sniff network traffic to leverage this issue.

Recommendations For WellinTech KingHistorian version 35.01.00.05, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of the User authentication functionality to reduce the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Improper Authentication

Information Disclosure

Enumeração de Fraquezas

CWE-287

CWE-200

Identificadores relacionados

CVE-2022-45124

Produtos afetados

Kinghistorian

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1683 · Exploit
• https://t.me/cibsecurity/60353 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-45124 · Aviso do Fabricante
• https://t.me/cvenotify/46542 · Publicação no Telegram
• https://t.me/true_secator/4203 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45124 · Nota de Segurança