Описание
CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access.
Ссылки
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 6.6 (включая)
Одно из
cpe:2.3:a:toshiba:chec:*:*:*:*:*:*:*:*
cpe:2.3:a:toshiba:chec:6.7:*:*:*:*:*:*:*
EPSS
Процентиль: 79%
0.02063
Низкий
5 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
github
около 4 лет назад
CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access.
EPSS
Процентиль: 79%
0.02063
Низкий
5 Medium
CVSS2
Дефекты
CWE-200