PT-2023-24367 · Ibermatica · Ibermatica Rps

Francisco Javier Medina Munuera · Published 2023-10-03 · Updated 2024-09-23 · CVE-2023-3350

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBERMATICA RPS version 2019

Description A cryptographic issue has been found, allowing an attacker to download a log file and retrieve SQL queries sent to the application in plain text. The log file contains password hashes coded with the AES-CBC-128 bits algorithm, which can be decrypted using a .NET function to obtain the username's password in plain text.

Recommendations For IBERMATICA RPS version 2019, consider restricting access to the log file to prevent unauthorized downloads, and avoid using the .NET function to decrypt password hashes until a patch is available. As a temporary workaround, consider implementing additional security measures to protect password hashes, such as using a more secure encryption algorithm or hashing method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Insertion into Log File

Weakness Enumeration

CWE-327

CWE-532

Related Identifiers

CVE-2023-3350

Affected Products

Ibermatica Rps

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3350 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3350 · Vendor Advisory
• https://t.me/cibsecurity/71516 · Telegram Post
• https://twitter.com/CVEnew/status/1709201349458481214 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019 · Note
• https://t.me/cvenotify/59030 · Telegram Post
• https://t.me/cvenotify/95723 · Telegram Post