CVE-2020-27688

HIGH

7.5

Descricao

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado11/5/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

robware:rvtools

Fraquezas (CWE)

CWE-522

Referencias

https://github.com/matthiasmaes/CVE-2020-27688(cve@mitre.org)

https://www.robware.net/rvtools/(cve@mitre.org)

https://github.com/matthiasmaes/CVE-2020-27688(af854a3a-2127-422b-91ae-364da2661108)

https://www.robware.net/rvtools/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.