by Kastro
Paper/Archive/CVE-2022-24860

CVE-2022-24860

vran-dev databasir — Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.0.770 × 2015.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.

Affected

ProductAffectedFixed inSource
databasir > 1.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpggrefgithub.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.javarefuser-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.pngrefuser-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.pngrefuser-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png