PT-2018-12614 · Thomson Reuters · Thomson Reuters Ultratax Cs

Published 2018-07-26 · Updated 2024-02-14 · CVE-2018-14608

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thomson Reuters UltraTax CS version 2017

Description The software has a password protection option, but the level of protection may not meet some customers' expectations because the data is stored in cleartext. Customer data is stored in unique directories and can be accessed without authentication by examining the strings of the .XX17 file. These strings contain sensitive customer information, including Full Name, Spouse's Name, Social Security Number, Date of Birth, Occupation, Home Address, Daytime Phone Number, Home Phone Number, and other personal details.

Recommendations For Thomson Reuters UltraTax CS version 2017, consider implementing additional security measures to protect customer data, such as encrypting the .XX17 files or restricting access to the directories where the files are stored. As a temporary workaround, restrict access to the sensitive directories (%install path%WinCSIUT17DATAclient IDfile name.XX17) to minimize the risk of unauthorized data access.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-14608

Affected Products

Thomson Reuters Ultratax Cs

References · 4

• 🔥 https://corporateblue.com/ultratax-cs-data-exposure-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2018-14608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14608 · Security Note
• https://themikewylie.com/ultratax-cs-data-exposure-vulnerability-cve-2018-14608-cve-2018-14607 · Note