Lucene search

[email protected]CVE-2020-14489

HistoryJul 29, 2020 - 1:15 p.m.

CVE-2020-14489

2020-07-2913:15:00

CWE-522

[email protected]

web.nvd.nist.gov

cve-2020-14489

openclinic ga

password hashing

security

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

52.2%

JSON

OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques.

CPENameOperatorVersion
openclinic_ga_project:openclinic_gaopenclinic ga project openclinic gaeq5.09.02
openclinic_ga_project:openclinic_gaopenclinic ga project openclinic gaeq5.89.05b

CPE	Name	Operator	Version
openclinic_ga_project:openclinic_ga	openclinic ga project openclinic ga	eq	5.09.02
openclinic_ga_project:openclinic_ga	openclinic ga project openclinic ga	eq	5.89.05b

References

us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

52.2%

JSON

Related for CVE-2020-14489

prion1 ics1