PT-2021-23600 · Xorux · Lpar2Rrd+1

Simon Geusebroek · Published 2021-11-08 · Updated 2022-07-29 · CVE-2021-42370

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XoruX LPAR2RRD versions prior to 7.30 STOR2RRD versions prior to 7.30

Description A password mismanagement situation exists because cleartext information is present in HTML password input fields in the device properties. Viewing the passwords requires configuring a web browser to display HTML password input fields.

Recommendations For XoruX LPAR2RRD versions prior to 7.30, update to version 7.30 or later to resolve the issue. For STOR2RRD versions prior to 7.30, update to version 7.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the device properties page to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-42370

GHSA-F3QP-4XQQ-2WJX

Affected Products

Lpar2Rrd

Stor2Rrd

References · 7

• https://osv.dev/vulnerability/CVE-2021-42370 · Vendor Advisory
• https://stor2rrd.com/note730.php · Vendor Advisory
• https://lpar2rrd.com/note730.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42370 · Security Note
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx · Note
• https://t.me/cibsecurity/31960 · Telegram Post
• https://t.me/cvenotify/23192 · Telegram Post