mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
122 lines
4.3 KiB
JSON
122 lines
4.3 KiB
JSON
{
|
|
"id": "CVE-2024-4996",
|
|
"sourceIdentifier": "cvd@cert.pl",
|
|
"published": "2024-12-18T12:15:10.120",
|
|
"lastModified": "2024-12-18T15:15:12.210",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Use of a hard-coded password for a database administrator account created during Wapro ERP\u00a0installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP\u00a0installations.\u00a0This issue affects Wapro ERP Desktop versions before 8.90.0."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "El uso de una contrase\u00f1a codificada para una cuenta de administrador de base de datos creada durante la instalaci\u00f3n de Wapro ERP permite a un atacante recuperar datos confidenciales integrados almacenados en la base de datos. La contrase\u00f1a es la misma en todas las instalaciones de Wapro ERP. Este problema afecta a las versiones de escritorio de Wapro ERP anteriores a la 8.90.0."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV40": [
|
|
{
|
|
"source": "cvd@cert.pl",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "4.0",
|
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:M/U:Red",
|
|
"baseScore": 9.3,
|
|
"baseSeverity": "CRITICAL",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"attackRequirements": "NONE",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"vulnConfidentialityImpact": "HIGH",
|
|
"vulnIntegrityImpact": "HIGH",
|
|
"vulnAvailabilityImpact": "HIGH",
|
|
"subConfidentialityImpact": "NONE",
|
|
"subIntegrityImpact": "NONE",
|
|
"subAvailabilityImpact": "NONE",
|
|
"exploitMaturity": "NOT_DEFINED",
|
|
"confidentialityRequirement": "NOT_DEFINED",
|
|
"integrityRequirement": "NOT_DEFINED",
|
|
"availabilityRequirement": "NOT_DEFINED",
|
|
"modifiedAttackVector": "NOT_DEFINED",
|
|
"modifiedAttackComplexity": "NOT_DEFINED",
|
|
"modifiedAttackRequirements": "NOT_DEFINED",
|
|
"modifiedPrivilegesRequired": "NOT_DEFINED",
|
|
"modifiedUserInteraction": "NOT_DEFINED",
|
|
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
|
|
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
|
|
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
|
|
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
|
|
"modifiedSubIntegrityImpact": "NOT_DEFINED",
|
|
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
|
|
"Safety": "NOT_DEFINED",
|
|
"Automatable": "YES",
|
|
"Recovery": "IRRECOVERABLE",
|
|
"valueDensity": "CONCENTRATED",
|
|
"vulnerabilityResponseEffort": "MODERATE",
|
|
"providerUrgency": "RED"
|
|
}
|
|
}
|
|
],
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 5.9
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "cvd@cert.pl",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert.pl/en/posts/2024/12/CVE-2024-4995/",
|
|
"source": "cvd@cert.pl"
|
|
},
|
|
{
|
|
"url": "https://cert.pl/posts/2024/12/CVE-2024-4995/",
|
|
"source": "cvd@cert.pl"
|
|
},
|
|
{
|
|
"url": "https://wapro.pl/",
|
|
"source": "cvd@cert.pl"
|
|
}
|
|
]
|
|
} |