CVE-2022-2921 – notrinos/notrinos-erp

Package

Manager: composer
Name: notrinos/notrinos-erp
Vulnerable Version: >=0 <0.7

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00458 pctl0.63121

Details

Exposure of password hashes in notrinos/notrinos-erp The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.

Metadata

Created: 2022-08-22T00:00:52Z
Modified: 2022-08-30T20:49:50Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-44w5-q257-8428/GHSA-44w5-q257-8428.json
CWE IDs: ["CWE-359"]
Alternative ID: GHSA-44w5-q257-8428
Finding: F038
Auto approve: 1