CWE-522
Allowed-with-ReviewInsufficiently Protected Credentials
Abstraction: Class · Status: Incomplete
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
1820 vulnerabilities reference this CWE, most recent first.
GHSA-2MVF-3MC9-CJQ9
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2023-02-27 18:32Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
{
"affected": [],
"aliases": [
"CVE-2019-0175"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-13T16:29:00Z",
"severity": "MODERATE"
},
"details": "Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.",
"id": "GHSA-2mvf-3mc9-cjq9",
"modified": "2023-02-27T18:32:07Z",
"published": "2022-05-24T16:47:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0175"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/in"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2MWM-HHV7-V7HX
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2025-05-05 18:32Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access.
{
"affected": [],
"aliases": [
"CVE-2022-30601"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access.",
"id": "GHSA-2mwm-hhv7-v7hx",
"modified": "2025-05-05T18:32:23Z",
"published": "2022-08-19T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30601"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221014-0004"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2MXM-3CXJ-6CMP
Vulnerability from github – Published: 2025-03-05 15:30 – Updated: 2025-03-05 15:30Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnerability could allow an authenticated user to obtain higher privileged user’s sensitive information via crafted payload.
This issue affects Identity Manager Advanced Edition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0.
{
"affected": [],
"aliases": [
"CVE-2024-12799"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T15:15:13Z",
"severity": "CRITICAL"
},
"details": "Insufficiently Protected Credentials\nvulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux,\n64 bit allows Privilege Abuse. This vulnerability could allow an\nauthenticated user to obtain higher privileged user\u2019s sensitive information via\ncrafted payload.\n\nThis issue affects Identity Manager Advanced\nEdition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0.",
"id": "GHSA-2mxm-3cxj-6cmp",
"modified": "2025-03-05T15:30:57Z",
"published": "2025-03-05T15:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12799"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000037455"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-2PJ4-MR9M-QWWW
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:22Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \192.168.0.2\C$\file.pdf without user interaction.
{
"affected": [],
"aliases": [
"CVE-2019-17497"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-11T00:15:00Z",
"severity": "MODERATE"
},
"details": "Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\\\192.168.0.2\\C$\\file.pdf without user interaction.",
"id": "GHSA-2pj4-mr9m-qwww",
"modified": "2024-04-04T02:22:30Z",
"published": "2022-05-24T16:58:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17497"
},
{
"type": "WEB",
"url": "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2PM6-HR95-GGXQ
Vulnerability from github – Published: 2025-08-12 12:30 – Updated: 2025-08-12 12:30A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.
{
"affected": [],
"aliases": [
"CVE-2025-40751"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T12:15:36Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.",
"id": "GHSA-2pm6-hr95-ggxq",
"modified": "2025-08-12T12:30:33Z",
"published": "2025-08-12T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40751"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-707630.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2Q27-4JJ5-PPF3
Vulnerability from github – Published: 2022-11-28 18:30 – Updated: 2022-12-02 00:30IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.
{
"affected": [],
"aliases": [
"CVE-2022-41732"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-28T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.",
"id": "GHSA-2q27-4jj5-ppf3",
"modified": "2022-12-02T00:30:25Z",
"published": "2022-11-28T18:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41732"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/237407"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6841617"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2QPM-XF67-JJ26
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2022-10-07 18:15Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.
{
"affected": [],
"aliases": [
"CVE-2019-10210"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-29T19:15:00Z",
"severity": "HIGH"
},
"details": "Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.",
"id": "GHSA-2qpm-xf67-jj26",
"modified": "2022-10-07T18:15:57Z",
"published": "2022-05-24T17:00:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10210"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10210"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/about/news/1960"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2R94-WM5V-4PRX
Vulnerability from github – Published: 2025-04-08 21:31 – Updated: 2025-10-23 22:22Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/project-community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.7-beta1"
},
{
"fixed": "2.4.7-p5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.6-p1"
},
{
"fixed": "2.4.6-p10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.5-p1"
},
{
"fixed": "2.4.5-p12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.4-p13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.8-beta1"
},
{
"fixed": "2.4.8-beta2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.5"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.4"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.6"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"versions": [
"2.4.7"
]
}
],
"aliases": [
"CVE-2025-27192"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-23T22:22:08Z",
"nvd_published_at": "2025-04-08T21:15:51Z",
"severity": "LOW"
},
"details": "Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.",
"id": "GHSA-2r94-wm5v-4prx",
"modified": "2025-10-23T22:22:08Z",
"published": "2025-04-08T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27192"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb25-26.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Magento does not properly protect credentials"
}
GHSA-2RCP-JVR4-R259
Vulnerability from github – Published: 2023-10-20 15:18 – Updated: 2023-12-19 19:08Impact
This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration.
The Tauri documentation used an insecure example configuration in the Vite guide to showcase how to use Tauri together with Vite.
Copying the following snippet envPrefix: ['VITE_', 'TAURI_'], from this guide into the vite.config.ts of a Tauri project possibly leads to bundling the TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD into the Vite frontend code and therefore leaking this value to the debug built of a Tauri application.
The value is automatically bundled into debug builds but for production builds it is not embedded, as long as it is not directly referenced in the frontend code. Vite statically replaces these values in production builds. This reduces the amount of affected applications to a very small amount of affected applications.
To verify if you are affected you can search for the private key value or the TAURI_PRIVATE_KEY variable inside the release build frontend assets (dist/).
Example:
grep -r "TAURI_PRIVATE_KEY" dist/
Using only the envPrefix: ['VITE_'], or any other framework than Vite means you are not impacted by this advisory.
Patches
The documentation has been patched but as the root cause is not in Tauri itself the issue is not fixed by updating Tauri.
The vite.config.ts configuration of the project needs to be adapted.
We recommend rotating your updater private key if you are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with tauri signer generate, saving the new private key and updating the updater's pubkey value on tauri.conf.json with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Workarounds
The envPrefix: ['VITE_'],should be used and the desired TAURI variables manually added.
Respective these variables could be added TAURI_PLATFORM, TAURI_ARCH, TAURI_FAMILY, TAURI_PLATFORM_VERSION, TAURI_PLATFORM_TYPE and TAURI_DEBUG without leaking sensitive information.
We urge affected users to implement the workaround as the 1.x branch will not receive a general prevention fix as it would break systems.
References
The issue was originally disclosed in our discord here. The affected guide is https://tauri.app/v1/guides/getting-started/setup/vite/.
Update: We lowered the severity from high to low, as the likelihood of impact was found to only affect a very limited amount of applications.
Update2: We changed the affected versions to make clear that after
2.0.0-alpha.16or1.5.6the potentially vulnerable recommendation was no longer visible on our website and should not affect projects by default. A lot of users were confused and we believe this advisory reached the necessary user base.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "tauri-cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "2.0.0-alpha.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@tauri-apps/cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "2.0.0-alpha.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@tauri-apps/cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "tauri-cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46115"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-20T15:18:52Z",
"nvd_published_at": "2023-10-20T00:15:16Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThis advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration.\n\nThe Tauri documentation used an insecure example configuration in the [Vite guide](https://tauri.app/v1/guides/getting-started/setup/vite/) to showcase how to use Tauri together with Vite. \n\nCopying the following snippet `envPrefix: [\u0027VITE_\u0027, \u0027TAURI_\u0027],` from this guide into the `vite.config.ts` of a Tauri project possibly leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the debug built of a Tauri application.\n\nThe value is automatically bundled into debug builds but for production builds it is not embedded, as long as it is not directly referenced in the frontend code. Vite statically replaces these values in production builds. This reduces the amount of affected applications to a very small amount of affected applications.\n\nTo verify if you are affected you can search for the private key value or the `TAURI_PRIVATE_KEY` variable inside the release build frontend assets (`dist/`).\n\n\u003e Example: `grep -r \"TAURI_PRIVATE_KEY\" dist/`\n\nUsing only the `envPrefix: [\u0027VITE_\u0027],` or any other framework than Vite means you are not impacted by this advisory.\n\n### Patches\n\nThe documentation has been patched but as the root cause is not in Tauri itself the issue is not fixed by updating Tauri.\nThe `vite.config.ts` configuration of the project needs to be adapted.\n\nWe recommend rotating your updater private key if you are affected by this (requires Tauri CLI \u003e=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater\u0027s `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.\n\n### Workarounds\n\nThe `envPrefix: [\u0027VITE_\u0027],`should be used and the desired `TAURI` variables manually added.\nRespective these variables could be added `TAURI_PLATFORM`, `TAURI_ARCH`, `TAURI_FAMILY`, `TAURI_PLATFORM_VERSION`, `TAURI_PLATFORM_TYPE` and `TAURI_DEBUG` without leaking sensitive information.\n\nWe urge affected users to implement the workaround as the `1.x` branch will not receive a general prevention fix as it would break systems.\n\n### References\nThe issue was originally disclosed in our discord [here](https://discord.com/channels/616186924390023171/1164260301655523409).\nThe affected guide is [https://tauri.app/v1/guides/getting-started/setup/vite/](https://tauri.app/v1/guides/getting-started/setup/vite/).\n\n\n\u003e Update: We lowered the severity from high to low, as the likelihood of impact was found to only affect a **very limited** amount of applications.\n\n\u003e Update2: We changed the affected versions to make clear that after `2.0.0-alpha.16` or `1.5.6` the potentially vulnerable recommendation was no longer visible on our website and should not affect projects by default. A lot of users were confused and we believe this advisory reached the necessary user base.\n",
"id": "GHSA-2rcp-jvr4-r259",
"modified": "2023-12-19T19:08:00Z",
"published": "2023-10-20T15:18:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46115"
},
{
"type": "WEB",
"url": "https://github.com/tauri-apps/tauri/commit/8b166e9bf82e69ddb3200a3a825614980bd8d433"
},
{
"type": "WEB",
"url": "https://discord.com/channels/616186924390023171/1164260301655523409"
},
{
"type": "PACKAGE",
"url": "https://github.com/tauri-apps/tauri"
},
{
"type": "WEB",
"url": "https://tauri.app/v1/guides/getting-started/setup/vite"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Tauri\u0027s Updater Private Keys Possibly Leaked via Vite Environment Variables"
}
GHSA-2RP4-HM5G-P38J
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.
{
"affected": [],
"aliases": [
"CVE-2019-19843"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-22T19:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.",
"id": "GHSA-2rp4-hm5g-p38j",
"modified": "2022-05-24T17:07:07Z",
"published": "2022-05-24T17:07:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19843"
},
{
"type": "WEB",
"url": "https://alephsecurity.com/2020/01/14/ruckus-wireless"
},
{
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html"
},
{
"type": "WEB",
"url": "https://www.ruckuswireless.com/security/299/view/txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Use an appropriate security mechanism to protect the credentials.
Mitigation
Make appropriate use of cryptography to protect the credentials.
Mitigation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
CAPEC-102: Session Sidejacking
Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
CAPEC-474: Signature Spoofing by Key Theft
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.
CAPEC-509: Kerberoasting
Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service ticket with portions encrypted via RC4 with the private key of the authenticated account. By extracting the local ticket and saving it disk, the adversary can brute force the hashed value to reveal the target account credentials.
CAPEC-551: Modify Existing Service
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
CAPEC-555: Remote Services with Stolen Credentials
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-561: Windows Admin Shares with Stolen Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-644: Use of Captured Hashes (Pass The Hash)
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
CAPEC-645: Use of Captured Tickets (Pass The Ticket)
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.