PT-2021-23275 · Unknown · Wallstreet Suite Trm

Dominique Righetto · CVE-2021-41320 · Published 2021-10-15 · Updated 2024-08-04

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AC:L/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Wallstreet Suite TRM version 7.4.83

Description A technical user has hardcoded credentials with higher privilege than the average authenticated user. The vendor disputes this claim, stating that the password is not hardcoded as it can be changed during installation or at any later time.

Recommendations For Wallstreet Suite TRM version 7.4.83, consider changing the default credentials during installation or at a later time to mitigate the risk of exploitation. As a temporary workaround, restrict access to the technical user account with higher privileges until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-41320

Affected Products

Wallstreet Suite Trm

References · 9

• https://osv.dev/vulnerability/CVE-2021-41320 · Vendor Advisory
• https://iongroup.com/ion-treasury/products/wallstreet-suite · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41320 · Security Note
• https://t.me/cvenotify/81083 · Telegram Post
• https://client-connect.iongroup.com/library/content/treasury-management/wallstreet-suite/security/suite-7-4-83/user-passwords · Note
• https://t.me/cvenotify/88899 · Telegram Post
• https://t.me/cibsecurity/30660 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-41320 · Note
• https://excellium-services.com/cert-xlm-advisory/CVE-2021-41320 · Note