PT-2017-10889 · Cygnux · Syspass

Artem · Published 2017-11-17 · Updated 2019-10-03 · CVE-2017-1000192

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cygnux sysPass versions 2.1.7 and older

Description The issue allows for Local File Inclusion in the functionality of javascript files inclusion, enabling an attacker to read sensitive information such as configuration files containing database login and password, private encryption key, and other sensitive data.

Recommendations For Cygnux sysPass versions 2.1.7 and older, update to a version newer than 2.1.7 to resolve the issue.

Fix

Related Identifiers

CVE-2017-1000192

Affected Products

Syspass

References · 3

• https://osv.dev/vulnerability/CVE-2017-1000192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000192 · Security Note
• https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901 · Note