PT-2021-21683 · Nch · Nch Reflect Crm

Published 2021-07-25 · Updated 2022-07-12 · CVE-2021-37468

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NCH Reflect CRM version 3.01

Description The issue allows local users to discover cleartext user account information by reading the configuration files.

Recommendations For NCH Reflect CRM version 3.01, consider restricting access to the configuration files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-37468

Affected Products

Nch Reflect Crm

References · 4

• 🔥 https://github.com/0xfml/poc/blob/main/NCH/ReflectCRM_3.01_CC.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-37468 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37468 · Vendor Advisory
• https://nchsoftware.com/crm/index.html · Note