Vulnerability · Published Apr 19, 2022 · Assigned by GitHub_M
CVE-2022-24860Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
High 7.4
In plain English
A high-severity security flaw in databasir from vran-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.
Affected products (as reported)
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpgg x_refsource_CONFIRM
- https://github.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java x_refsource_MISC
- https://user-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png x_refsource_MISC
- https://user-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png x_refsource_MISC
- https://user-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png x_refsource_MISC
