CVE-2017-1000192 : Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion i

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information.

Published 2017-11-17 17:29:00

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: File inclusion

Products affected by CVE-2017-1000192

Cygnux » Syspass
Versions up to, including, (<=) 2.1.7
cpe:2.3:a:cygnux:syspass:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-1000192

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-1000192

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2017-1000192

https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901

Release sysPass 2.1.8 - Critical Fix · nuxsmin/sysPass · GitHub
Release Notes;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-1000192

Products affected by CVE-2017-1000192

Exploit prediction scoring system (EPSS) score for CVE-2017-1000192

CVSS scores for CVE-2017-1000192

References for CVE-2017-1000192