PT-2015-4988 · Basware · Basware Banking

Samuel Lavitt · Published 2015-08-31 · Updated 2015-08-31 · CVE-2015-0943

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Basware Banking (Maksuliikenne) versions prior to 9.10.0.0

Description The issue allows man-in-the-middle attackers to obtain sensitive information, including encryption keys and user credentials, by sniffing the network or modifying the traffic. This is possible because communication between the client and the backend server is not encrypted.

Recommendations For versions prior to 9.10.0.0, update to version 9.10.0.0 or later to ensure encryption of communication between the client and the backend server.

Fix

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

CVE-2015-0943

Affected Products

Basware Banking

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-0943 · Security Note
• https://viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html · Note
• http://seclists.org/fulldisclosure/2015/Jul/120 · Note