PT-2020-12230 · Visam · Visam Vbase Editor+1

Published 2020-04-03 · Updated 2021-12-20 · CVE-2020-10601

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VISAM VBASE Editor version 11.5.0.2 VBASE Web-Remote Module

Description The issue concerns a weak hashing algorithm and insecure permissions, potentially allowing a local attacker to bypass the password-protected mechanism. This could be achieved through brute-force attacks, cracking techniques, or overwriting the password hash.

Recommendations For VISAM VBASE Editor version 11.5.0.2, consider updating the hashing algorithm to a more secure one and review the permissions settings to ensure they are properly configured. For VBASE Web-Remote Module, restrict access to the module until a secure hashing algorithm and proper permissions are implemented. As a temporary workaround, consider disabling password hash storage or limiting access to the password-protected mechanism until the issue is resolved.

Fix

Inadequate Encryption Strength

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-326

CWE-327

Related Identifiers

CVE-2020-10601

Affected Products

Vbase Web-Remote Module

Visam Vbase Editor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10601 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10601 · Vendor Advisory
• https://t.me/cvenotify/2407 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-20-084-01 · Note