GHSA-44w5-q257-8428

ghsaUSosv

Exposure of password hashes in notrinos/notrinos-erp

view advisory published 2022-08-22Licence: CC-BY-4.0

The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-2921US	high8.8	1.36% (72nd)	—	2022-08-21
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administ…

references

External citations — patches, advisories, analysis.

https://github.com/notrinos/NotrinosERPPACKAGE
https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45WEB
https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115cWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-2921ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan