PT-2023-24367 · Ibermatica · Ibermatica Rps

Francisco Javier Medina Munuera · Publicado 2023-10-03 · Atualizado 2024-09-23 · CVE-2023-3350

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBERMATICA RPS version 2019

Description A cryptographic issue has been found, allowing an attacker to download a log file and retrieve SQL queries sent to the application in plain text. The log file contains password hashes coded with the AES-CBC-128 bits algorithm, which can be decrypted using a .NET function to obtain the username's password in plain text.

Recommendations For IBERMATICA RPS version 2019, consider restricting access to the log file to prevent unauthorized downloads, and avoid using the .NET function to decrypt password hashes until a patch is available. As a temporary workaround, consider implementing additional security measures to protect password hashes, such as using a more secure encryption algorithm or hashing method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Insertion into Log File

Enumeração de Fraquezas

CWE-327

CWE-532

Identificadores relacionados

CVE-2023-3350

Produtos afetados

Ibermatica Rps

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3350 · Nota de Segurança
• https://t.me/cibsecurity/71516 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1709201349458481214 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019 · Nota
• https://t.me/cvenotify/59030 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3350 · Aviso do Fabricante
• https://t.me/cvenotify/95723 · Publicação no Telegram