PT-2020-9651 · Inextrix · Inextrix Astpp

Published 2020-03-20 · Updated 2021-07-21 · CVE-2019-15075

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iNextrix ASTPP versions prior to 4.0.1

Description An issue was discovered in the web interface/astpp/application/config/config.php file, where it does not have strong random keys. This is demonstrated by the use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider regenerating the private key and encryption key with strong random values to minimize the risk of exploitation. Restrict access to the web interface/astpp/application/config/config.php file to prevent unauthorized modifications.

Fix

Using Hardcoded Credentials

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-798

CWE-327

Related Identifiers

CVE-2019-15075

Affected Products

Inextrix Astpp

References · 4

• https://github.com/iNextrix/ASTPP/commit/9877ec62556f0470030acd306b24bc94fdcbe2ae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-15075 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15075 · Vendor Advisory
• https://t.me/cvenotify/1957 · Telegram Post