PT-2022-4438 · Unknown · Notrinoserp

Published 2022-08-22 · Updated 2022-08-23 · CVE-2022-2927

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions notrinoserp versions prior to 0.7

Description The issue is related to weak password requirements in the notrinoserp web system management. This weakness can be exploited by a remote attacker to elevate their privileges. The problem arises from missing password strength checks for new account passwords.

Recommendations For versions prior to 0.7, update to version 0.7 or later to resolve the issue. As a temporary workaround, consider implementing a password strength check for new account passwords until a patch is available. Restrict access to password management features to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2022-05302

CVE-2022-2927

GHSA-QHM8-69QH-G76J

Affected Products

Notrinoserp

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2927.json · Exploit
• 🔥 https://huntr.dev/bounties/7fa956dd-f541-4dcd-987d-ba15caa6a886 · Exploit
• https://github.com/notrinos/notrinoserp/commit/e61e76b44c6a2b28a4a648a06ef34f65c376ec1e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2927 · Security Note
• https://osv.dev/vulnerability/GHSA-qhm8-69qh-g76j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2927 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05302 · Security Note
• https://github.com/notrinos/notrinoserp · Note