PT-2021-9153 · Psyprax · Psyprax

Published 2021-02-05 · Updated 2021-07-21 · CVE-2020-10554

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Psyprax versions prior to 3.2.2

Description An issue was discovered where passwords used to encrypt data are stored in the database in an obfuscated format, which can be easily reverted. For example, the password AAAAAAAA is stored in the database as MMMMMMMM.

Recommendations For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation. Avoid using weak passwords and ensure that all passwords are complex and unique to prevent easy reversal of the obfuscated format.

Fix

Insufficiently Protected Credentials

Inadequate Encryption Strength

Weakness Enumeration

CWE-522

CWE-326

Related Identifiers

CVE-2020-10554

Affected Products

Psyprax

References · 4

• https://osv.dev/vulnerability/CVE-2020-10554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10554 · Security Note
• https://x41-dsec.de/lab/advisories/x41-2020-002-psyprax · Note
• https://t.me/cibsecurity/23181 · Telegram Post