PT-2020-9366 · Unknown · Bond Jetselect

Published 2020-05-14 · Updated 2021-07-21 · CVE-2019-13021

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bond JetSelect versions (affected versions not specified)

Description: The issue concerns the storage of administrative passwords in an unprotected file on the filesystem, rather than being encrypted within the MySQL database. This file is created during the installation script after the administrator generates a password. As a result, any low-privilege user who can read this file can easily obtain the passwords for the administrative accounts of the JetSelect application. The file containing the encoded password hash is located at /opt/JetSelect/SFC/resources/sfc-general-properties.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2019-13021

Affected Products

Bond Jetselect

References · 3

• 🔥 https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13021 · Security Note
• https://t.me/cibsecurity/12077 · Telegram Post