Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.
References
| Link | Resource |
|---|---|
| https://integriaims.com/en/services/updates/ | Release Notes Vendor Advisory |
| https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-incorrect-authorization |
Configurations
History
09 Nov 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords. | |
| References |
|
|
27 Oct 2022, 13:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-697 |
15 Oct 2021, 02:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://www.incibe-cert.es/en/early-warning/security-advisories/integria-ims-incorrect-authorization - Third Party Advisory | |
| References | (CONFIRM) https://integriaims.com/en/services/updates/ - Release Notes, Vendor Advisory | |
| CPE | cpe:2.3:a:artica:integria_ims:5.0.92:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CWE | CWE-863 |
07 Oct 2021, 16:51
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-07 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-3833
Mitre link : CVE-2021-3833
CVE.ORG link : CVE-2021-3833
JSON object : View
Products Affected
artica
- integria_ims
CWE
CWE-697
Incorrect Comparison