PT-2024-36553 · Weasis · Weasis

Partywave · Published 2024-12-13 · Updated 2024-12-17 · CVE-2024-55557

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weasis version 4.5.1

Description The issue concerns a hardcoded key for symmetric encryption of proxy credentials in the ui/pref/ProxyPrefView.java file within the weasis-core component of Weasis. This hardcoded key is used for the symmetric encryption of proxy credentials.

Recommendations For Weasis version 4.5.1, consider disabling the symmetric encryption of proxy credentials until a patch is available that addresses the hardcoded key issue. Restrict access to the ui/pref/ProxyPrefView.java file to minimize the risk of exploitation. Avoid using the hardcoded key for symmetric encryption of proxy credentials in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-55557

Affected Products

Weasis

References · 11

• 🔥 https://github.com/partywavesec/CVE-2024-55557 · Exploit
• https://osv.dev/vulnerability/CVE-2024-55557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55557 · Security Note
• https://github.com/nroduit/Weasis/releases/tag/v4.5.1 · Note
• https://twitter.com/CVEnew/status/1868773321371701640 · Twitter Post
• https://t.me/cvedetector/13042 · Telegram Post
• https://t.me/rnetsec/21067 · Telegram Post
• https://t.me/defcon_news/126963 · Telegram Post
• https://t.me/secharvester/17778 · Telegram Post
• https://partywave.site/show/research/CVE-2024-55557%20-%20Weasis%204.5.1 · Note
• https://apps.microsoft.com/detail/9nhtv46lg4nh?hl=en-us&gl=US · Note