PT-2017-14112 · Writediary · Diary With Lock

Published 2017-10-27 · Updated 2019-10-03 · CVE-2017-15581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Diary with lock (aka WriteDiary) version 4.72

Description The issue concerns the transmission of data without encryption in the Diary with lock application, which is intended for storing personal and sensitive information. This lack of encryption allows remote attackers to obtain sensitive information by sniffing the network during the execution of certain activities, such as LoginActivity or NoteActivity.

Recommendations For version 4.72, consider disabling the transmission of sensitive data over unencrypted connections as a temporary workaround until a patch is available that implements proper encryption, such as HTTPS, for data transmission. Restrict access to sensitive features like LoginActivity and NoteActivity to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2017-15581

Affected Products

Diary With Lock

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-15581 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15581 · Vendor Advisory
• https://gist.github.com/anonymous/603b89f864a71426042b167cab557efa · Note
• https://1337sec.blogspot.de/2017/10/auditing-writediarycom-cve-2017-15581.html · Note