When logging in to a VBASE runtime project via Web-Remote, the product uses XOR with a static initial key to obfuscate login messages. An unauthenticated remote attacker with the ability to capture a login session can obtain the login credentials.
References
Link | Resource |
---|---|
https://www.tenable.com/security/research/tra-2022-31 | Exploit Third Party Advisory |
Configurations
History
21 Sep 2022, 13:21
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
CWE | NVD-CWE-noinfo | |
CPE | cpe:2.3:a:visam:vbase:11.7.0.2:*:*:*:*:*:*:* | |
References | (MISC) https://www.tenable.com/security/research/tra-2022-31 - Exploit, Third Party Advisory | |
First Time |
Visam vbase
Visam |
16 Sep 2022, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-09-16 22:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-3217
Mitre link : CVE-2022-3217
CVE.ORG link : CVE-2022-3217
JSON object : View
Products Affected
visam
- vbase
CWE