Vulnerability · Published Oct 3, 2023 · Assigned by INCIBE
CVE-2023-3350Cryptographic Issues on IBERMATICA RPS
High 8.2
In plain English
A high-severity broken cryptography in IBERMATICA RPS 2019 from IBERMATICA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBERMATICA | IBERMATICA RPS 2019 | RPS 2019 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N