PT-2024-4032 · Unknown · Laborofficefree

Alejandro Baño Andrés + 3 · Published 2024-02-19 · Updated 2024-02-20 · CVE-2024-1344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LaborOfficeFree version 19.10

Description The issue affects the executable files LOF service.exe and LaborOfficeFree.exe, allowing an attacker to read and extract the username and password from the database. This can lead to unauthorized access to the application's database backup. The attacker can log in remotely with root-like privileges.

Recommendations For version 19.10, consider disabling the executable files LOF service.exe and LaborOfficeFree.exe until a patch is available to prevent exploitation. Restrict access to the directory '%programfiles(x86)%LaborOfficeFree' to minimize the risk of unauthorized access. Avoid using the default credentials for the database to reduce the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-04468

CVE-2024-1344

Affected Products

Laborofficefree

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-1344 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1344 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04468 · Security Note
• https://twitter.com/CVEnew/status/1759539175320170962 · Twitter Post
• https://t.me/cvenotify/71902 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree · Note