CVE-2020-14489 - OpenCVE

OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Openclinic Ga Project	Openclinic Ga

Configuration 1 [-]

OR	cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.09.02:::::::*
	cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.89.05b:::::::*

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2020-07-02T00:00:00

Updated: 2020-07-29T12:24:11

Reserved: 2020-06-19T00:00:00

Link: CVE-2020-14489

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-07-29T13:15:09.993

Modified: 2020-07-30T16:12:56.283

Link: CVE-2020-14489

JSON object: View

Redhat Information

No data.

CWE

CWE-522

{"containers": {"cna": {"affected": [{"product": "OpenClinic GA", "vendor": "open source", "versions": [{"status": "affected", "version": "5.09.02"}, {"status": "affected", "version": "5.89.05b"}]}], "credits": [{"lang": "en", "value": "Brian D. Hysell reported these vulnerabilities to CISA."}], "datePublic": "2020-07-02T00:00:00", "descriptions": [{"lang": "en", "value": "OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-07-29T12:24:11", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"}], "source": {"advisory": "ICSMA-20-184-01 OpenClinic GA", "discovery": "EXTERNAL"}, "title": "OpenClinic GA", "workarounds": [{"lang": "en", "value": "OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2020-07-02T00:00:00.000Z", "ID": "CVE-2020-14489", "STATE": "PUBLIC", "TITLE": "OpenClinic GA"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "OpenClinic GA", "version": {"version_data": [{"version_affected": "=", "version_value": "5.09.02"}, {"version_affected": "=", "version_value": "5.89.05b"}]}}]}, "vendor_name": "open source"}]}}, "credit": [{"lang": "eng", "value": "Brian D. Hysell reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522"}]}]}, "references": {"reference_data": [{"name": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"}]}, "source": {"advisory": "ICSMA-20-184-01 OpenClinic GA", "discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes."}]}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2020-14489", "datePublished": "2020-07-02T00:00:00", "dateReserved": "2020-06-19T00:00:00", "dateUpdated": "2020-07-29T12:24:11", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.09.02:*:*:*:*:*:*:*", "matchCriteriaId": "A64E5CCD-1F0D-46B2-9AE7-C917928D2788", "vulnerable": true}, {"criteria": "cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.89.05b:*:*:*:*:*:*:*", "matchCriteriaId": "BE2E5CDB-B864-45E4-A7EA-D7EE93BC2453", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques."}, {"lang": "es", "value": "OpenClinic GA versiones 5.09.02 y 5.89.05b, almacena contrase\u00f1as con una complejidad de hash inadecuada, lo que puede permitir a un atacante recuperar contrase\u00f1as usando t\u00e9cnicas conocidas de descifrado de contrase\u00f1as"}], "id": "CVE-2020-14489", "lastModified": "2020-07-30T16:12:56.283", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2020-07-29T13:15:09.993", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}