PT-2022-16568 · Extensis · Extensis Portfolio

Published 2022-03-01 · Updated 2022-03-09 · CVE-2022-24255

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0

Description The issue concerns hardcoded credentials in the software, which can be exploited by attackers to gain administrator privileges.

Recommendations For Extensis Portfolio version 4.0, consider changing the hardcoded credentials to unique, secure credentials as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-24255

Affected Products

Extensis Portfolio

References · 6

• 🔥 https://whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24255 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24255 · Vendor Advisory
• http://extensis.com · Note
• http://portfolio.com · Note
• https://t.me/cvenotify/27581 · Telegram Post