PT-2018-13139 · Btiteam · Xbtit

Rastating · Published 2018-09-05 · Updated 2019-10-03 · CVE-2018-15680

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4

Description An issue was discovered where the hashed passwords stored in the xbtit users table are stored as unsalted MD5 hashes. This makes it easier for attackers to obtain cleartext values via a brute-force attack.

Recommendations For BTITeam XBTIT version 2.5.4, consider updating the password storage mechanism to use a salted hashing algorithm to mitigate the risk of brute-force attacks. As a temporary workaround, restrict access to the xbtit users table to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2018-15680

Affected Products

Xbtit

References · 3

• 🔥 https://rastating.github.io/xbtit-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-15680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15680 · Security Note