PT-2021-8566 · Unknown · Sapphireims

Tanoy Bose · Published 2021-08-11 · Updated 2021-08-16 · CVE-2017-16632

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SapphireIMS version 4097 1

Description The password in the database is stored in Base64 format.

Recommendations For SapphireIMS version 4097 1, consider implementing proper password hashing and storage mechanisms to mitigate the risk of password exposure. As a temporary workaround, restrict access to the database to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2017-16632

Affected Products

Sapphireims

References · 6

• https://osv.dev/vulnerability/CVE-2017-16632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16632 · Security Note
• https://vuln.shellcoder.party/2020/07/18/cve-2017-16632-sapphireims-insecure-storage-of-password · Note
• https://t.me/cibsecurity/27206 · Telegram Post
• https://t.me/cvenotify/19449 · Telegram Post
• https://vuln.shellcoder.party/tags/sapphireims · Note