PT-2017-14282 · Sera · Sera

Mark Wadham · Published 2017-11-01 · Updated 2019-10-03 · CVE-2017-15918

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sera version 1.2

Description The issue allows for trivial privilege escalation and exposes user and system keychains to local attacks because it stores the user's login password in plain text in their home directory.

Recommendations For Sera version 1.2, consider removing or securing the plain text password storage to prevent local attacks and privilege escalation. As a temporary workaround, restrict access to the home directory where the password is stored to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-15918

Affected Products

Sera

References · 4

• 🔥 https://m4.rkw.io/blog/cve201715918-sera-12-local-root-privesc-and-password-disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/43221 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15918 · Security Note