PT-2024-1925 · Unknown · Mysql Server+1

Alejandro Baño Andrés + 3 · Published 2024-02-08 · Updated 2024-03-05 · CVE-2024-1346

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LaborOfficeFree version 19.10

Description The issue is related to a weak MySQL database root password in LaborOfficeFree. This allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants. The vulnerability is associated with weak password requirements. Exploitation of this issue may enable an attacker to obtain the root password of the MySQL database.

Recommendations For LaborOfficeFree version 19.10, consider changing the MySQL database root password to a stronger one to prevent exploitation. As a temporary workaround, restrict access to the MySQL database until a more secure password is implemented.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2024-01713

CVE-2024-1346

Affected Products

Laborofficefree

Mysql Server

References · 10

• https://osv.dev/vulnerability/CVE-2024-1346 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01713 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1346 · Security Note
• https://twitter.com/CVEnew/status/1759542741912985701 · Twitter Post
• https://twitter.com/gothburz/status/1761826913276838321 · Twitter Post
• https://vuldb.com/ru/?id.254102 · Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree · Note
• https://t.me/cybersecuritytechnologies/10044 · Telegram Post
• https://twitter.com/akaclandestine/status/1765019183526412498 · Twitter Post
• https://twitter.com/ksg93rd/status/1761993191488700744 · Twitter Post