PT-2017-7734 · Hitek · Automize

Published 2017-01-23 · Updated 2017-03-15 · CVE-2016-10101

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitek Software's Automize versions 10.x through 11.x

Description Information Disclosure can occur due to users having the Read attribute, which allows an attacker to recover the encrypted password and access the Password Manager.

Recommendations For versions 10.x through 11.x, consider restricting access to the passManager.jsd file to minimize the risk of exploitation. As a temporary workaround, limit the Read attribute for users to prevent unauthorized access to the Password Manager.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-255

Related Identifiers

CVE-2016-10101

Affected Products

Automize

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10101 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10101 · Vendor Advisory
• http://securityfocus.com/bid/96840 · Note
• https://rastamouse.me/guff/2016/automize · Note