PT-2018-12613 · Thomson Reuters · Thomson Reuters Ultratax Cs

User · Published 2018-07-26 · Updated 2024-02-14 · CVE-2018-14607

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thomson Reuters UltraTax CS version 2017

Description The software transfers customer records and bank account numbers in cleartext over SMBv2, allowing attackers to obtain sensitive information by sniffing the network or conduct man-in-the-middle (MITM) attacks. The customer record transferred in cleartext contains sensitive information such as Client ID, Full Name, Social Security Number, Bank Name, Bank Account Number, and other personal details.

Recommendations For Thomson Reuters UltraTax CS version 2017, consider implementing encryption for data transferred over the network to prevent eavesdropping and MITM attacks. As a temporary workaround, restrict access to the network to minimize the risk of exploitation. Avoid using SMBv2 for sensitive data transfer until a secure alternative is implemented.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-14607

Affected Products

Thomson Reuters Ultratax Cs

References · 3

• 🔥 https://corporateblue.com/ultratax-cs-data-exposure-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14607 · Security Note
• https://themikewylie.com/ultratax-cs-data-exposure-vulnerability-cve-2018-14608-cve-2018-14607 · Note