PT-2021-14363 · Unknown · Onlinevotingsystem

Bijaythapa · Published 2021-01-21 · Updated 2022-10-24 · CVE-2021-21253

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OnlineVotingSystem versions prior to 1.1.2

Description: The issue concerns the hashing of user passwords without a salt, making the system vulnerable to dictionary attacks. This vulnerability allows attackers to pre-compute hash values using techniques like rainbow tables, thereby increasing the risk of password cracking. The addition of a long, randomly generated salt to the password hash function enhances password protection.

Recommendations: For versions prior to 1.1.2, update to version 1.1.2 or later, which includes a fix for this issue by adding a long, randomly generated salt to the password hash function.

Fix

Weakness Enumeration

CWE-759

CWE-916

Related Identifiers

CVE-2021-21253

GHSA-WWG8-372V-V332

Affected Products

Onlinevotingsystem

References · 6

• https://github.com/dbijaya/OnlineVotingSystem/commit/0181cb0272857696c8eb3e44fcf6cb014ff90f09 · Patch
• https://osv.dev/vulnerability/CVE-2021-21253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21253 · Security Note
• https://github.com/dbijaya/OnlineVotingSystem/security/advisories/GHSA-wwg8-372v-v332 · Note
• https://t.me/cibsecurity/22497 · Telegram Post
• https://t.me/cvenotify/9252 · Telegram Post