PT-2014-3841 · Ecava · Integraxor

Luigi Auriemma · Published 2014-05-01 · Updated 2025-10-13 · CVE-2014-0786

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 4.1.4393

Description The issue allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. This is related to an information disclosure vulnerability.

Recommendations For versions prior to 4.1.4393, update to version 4.1.4393 or later to resolve the issue. As a temporary workaround, consider restricting access to the guest role to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-310

CWE-200

Related Identifiers

CVE-2014-0786

ZDI-14-117

ZDI-14-369

Affected Products

Integraxor

References · 8

• https://zerodayinitiative.com/advisories/ZDI-14-369 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-117 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-0786 · Security Note
• http://integraxor.com/blog/category/security/vulnerability-note · Vendor Advisory
• https://t.me/cveNotify/138473 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-14-091-01 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-14-224-01 · Note