Log in Start free

Vulnerability · Published Feb 19, 2024 · Assigned by INCIBE

CVE-2024-1344Encrypted database credentials in LaborOfficeFree

Medium 6.8

In plain English

A medium-severity hard-coded credentials in LaborOfficeFree from LaborOfficeFree . There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\LaborOfficeFree\' directory. This user can log in remotely and has root-like privileges.

Affected products (as reported)

VendorProductVersions
LaborOfficeFree LaborOfficeFree 19.10

Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References