← Back to CVEs
CVE-2019-7667
CRITICAL9.8
Description
Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login information, which can allow the attacker to bypass authentication and have full access to the system.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published7/1/2019
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
primasystems:flexair
Weaknesses (CWE)
CWE-330
References
http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html(cve@mitre.org)
https://applied-risk.com/labs/advisories(cve@mitre.org)
https://www.applied-risk.com/resources/ar-2019-007(cve@mitre.org)
https://www.us-cert.gov/ics/advisories/icsa-19-211-02(cve@mitre.org)
http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html(af854a3a-2127-422b-91ae-364da2661108)
https://applied-risk.com/labs/advisories(af854a3a-2127-422b-91ae-364da2661108)
https://www.applied-risk.com/resources/ar-2019-007(af854a3a-2127-422b-91ae-364da2661108)
https://www.us-cert.gov/ics/advisories/icsa-19-211-02(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.