Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
References
| Link | Resource |
|---|---|
| https://cwe.mitre.org/data/definitions/521.html | Third Party Advisory |
| https://cwe.mitre.org/data/definitions/916.html | Third Party Advisory |
| https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/ | Third Party Advisory |
| https://github.com/inoda/ontrack/issues/78 | Issue Tracking Third Party Advisory |
Configurations
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-916 CWE-287 |
14 Sep 2022, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-521 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Ontrack Project ontrack
Ontrack Project |
|
| CPE | cpe:2.3:a:ontrack_project:ontrack:3.4:*:*:*:*:*:*:* | |
| References | (MISC) https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/ - Third Party Advisory | |
| References | (MISC) https://cwe.mitre.org/data/definitions/521.html - Third Party Advisory | |
| References | (MISC) https://cwe.mitre.org/data/definitions/916.html - Third Party Advisory | |
| References | (MISC) https://github.com/inoda/ontrack/issues/78 - Issue Tracking, Third Party Advisory |
08 Sep 2022, 16:34
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-08 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-37164
Mitre link : CVE-2022-37164
CVE.ORG link : CVE-2022-37164
JSON object : View
Products Affected
ontrack_project
- ontrack