PT-2002-3013 · Lawson · Lawson Financials

Published 2002-12-31 · Updated 2017-07-29 · CVE-2002-2301

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Lawson Financials version 8.0

Description: The issue concerns the storage of usernames and passwords in a world-readable file when Lawson Financials is configured to use a third-party relational database. This allows local users to read the passwords and log onto the database.

Recommendations: For Lawson Financials version 8.0, consider restricting access to the file that stores usernames and passwords to prevent local users from reading the passwords and logging onto the database. As a temporary workaround, limit the use of third-party relational databases until a more secure configuration or update is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2002-2301

Affected Products

Lawson Financials

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2301 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10742 · Note
• http://seclists.org/lists/bugtraq/2002/Dec/0012.html · Note
• http://securityfocus.com/bid/6293 · Note