PT-2021-17678 · Adguard · Adguard

Jvoisin · Published 2021-03-03 · Updated 2022-07-12 · CVE-2021-27935

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: AdGuard versions prior to 0.105.2

Description: An issue was discovered where an attacker who obtains a user's cookie can bruteforce their password offline. This is possible because the hash of the password is stored in the cookie.

Recommendations: For versions prior to 0.105.2, update to version 0.105.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application that use the stored password hash until a patch is applied. Avoid using the application with sensitive accounts until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-27935

Affected Products

Adguard

References · 5

• https://github.com/AdguardTeam/AdGuardHome/issues/2470 · Patch
• https://osv.dev/vulnerability/CVE-2021-27935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27935 · Security Note
• https://t.me/cibsecurity/24425 · Telegram Post
• https://t.me/cvenotify/10867 · Telegram Post