CVE-2022-24860 : Databasir is a team-oriented relational database model document management platf

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.

Published 2022-04-20 00:16:51

Updated 2022-04-29 23:44:19

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-24860

Databasir Project » Databasir » Version: 1.0.1
cpe:2.3:a:databasir_project:databasir:1.0.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-24860

EPSS FAQ

0.96%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24860

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	2.2	5.2	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2022-24860

CWE-321 Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Assigned by: security-advisories@github.com (Secondary)
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-24860

https://github.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpgg

Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. · Advisory · vran-dev/databasir · GitHub
Third Party Advisory
https://user-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png

163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png (2264×1586)
Third Party Advisory
https://github.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java

databasir/JwtTokens.java at master · vran-dev/databasir · GitHub
Exploit;Third Party Advisory
https://user-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png

163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png (2300×1592)
Third Party Advisory
https://user-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png

163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png (2148×1574)
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-24860

Products affected by CVE-2022-24860

Exploit prediction scoring system (EPSS) score for CVE-2022-24860

CVSS scores for CVE-2022-24860

CWE ids for CVE-2022-24860

References for CVE-2022-24860