Lucene search

GitHub_MCVE-2022-24860

HistoryApr 20, 2022 - 12:16 a.m.

CVE-2022-24860

2022-04-2000:16:51

CWE-798

CWE-321

GitHub_M

web.nvd.nist.gov

677

cve-2022-24860

databasir

relational database

document management

vulnerability

hard-coded cryptographic key

ip addresses

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.008

Percentile

81.7%

JSON

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.

Affected configurations

Nvd

Vulners

Node

databasir_projectdatabasirMatch1.0.1

VendorProductVersionCPE
databasir_projectdatabasir1.0.1cpe:/a:databasir_project:databasir:1.0.1:::

Vendor	Product	Version	CPE
databasir_project	databasir	1.0.1	cpe:/a:databasir_project:databasir:1.0.1:::

CNA Affected

[
  {
    "product": "databasir",
    "vendor": "vran-dev",
    "versions": [
      {
        "status": "affected",
        "version": " > 1.0.1"
      }
    ]
  }
]

References

github.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java

github.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpgg

user-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png

user-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png

user-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.008

Percentile

81.7%

JSON

Related for CVE-2022-24860