Lucene search

MitreCVE-2020-29550

HistoryDec 23, 2020 - 4:15 p.m.

CVE-2020-29550

2020-12-2316:15:12

CWE-312

mitre

web.nvd.nist.gov

cve-2020-29550

urve

security issue

ms office 365 integration service

cleartext password

configuration files

database

html code

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.043

Percentile

92.5%

JSON

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.

Affected configurations

Nvd

Node

urveurveMatch24.03.2020

VendorProductVersionCPE
urveurve24.03.2020cpe:2.3:a:urve:urve:24.03.2020:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
urve	urve	24.03.2020	cpe:2.3:a:urve:urve:24.03.2020:::::::*

References

packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.html

seclists.org/fulldisclosure/2020/Dec/49

urve.co.uk/system-rezerwacji-sal

www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-042.txt

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.043

Percentile

92.5%

JSON

Related for CVE-2020-29550