PT-2017-14351 · Nq · Nq Contacts Backup & Restore

Published 2017-10-29 · Updated 2019-10-03 · CVE-2017-15999

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NQ Contacts Backup & Restore version 1.1

Description The application transmits login and synced user data without using HTTPS. During login, the username is sent in cleartext along with an SHA-1 hash of the password. This allows an attacker to either crack the hash or use it for further attacks where only the hash value is required.

Recommendations For version 1.1, consider disabling the login functionality until a secure version of the application is available, and avoid using the application for sensitive data transmission. Restrict access to the application's data to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-15999

Affected Products

Nq Contacts Backup & Restore

References · 3

• https://osv.dev/vulnerability/CVE-2017-15999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15999 · Security Note
• https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html · Note