Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
References
| Link | Resource |
|---|---|
| https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/ | Third Party Advisory |
| https://github.com/bminusl/ihatetobudget/issues/24 | Issue Tracking Third Party Advisory |
Configurations
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-916 CWE-287 |
13 Sep 2022, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ihatetobudget Project ihatetobudget
Ihatetobudget Project |
|
| CWE | CWE-521 | |
| References | (MISC) https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/ - Third Party Advisory | |
| References | (MISC) https://github.com/bminusl/ihatetobudget/issues/24 - Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:ihatetobudget_project:ihatetobudget:1.5.7:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
08 Sep 2022, 16:34
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-08 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-37163
Mitre link : CVE-2022-37163
CVE.ORG link : CVE-2022-37163
JSON object : View
Products Affected
ihatetobudget_project
- ihatetobudget