GitHub Advisoryadvisory · Packagist

GHSA-44w5-q257-8428 Exposure of password hashes in notrinos/notrinos-erp

HIGH Published 2022-08-22 Modified 2022-08-30 Official page ↗
Aliases
CVE-2022-2921
Ecosystem
Packagist
Packages
notrinos/notrinos-erp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-359
Reviewed
2022-08-30

Affected packages

• Packagist notrinos/notrinos-erp: < 0.7 → fixed in 0.7

Description

The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.

Related

Alias · CVE (1)

  • CVE-2022-2921 Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. vulnerability

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References