CVE-2019-13021

The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetstream:jetselect:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-05-14 17:15

Updated : 2024-02-28 17:47

NVD link : CVE-2019-13021

Mitre link : CVE-2019-13021

CVE.ORG link : CVE-2019-13021

JSON object : View

Products Affected

jetstream

jetselect

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2019-13021", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-05-14T17:15:11.677", "references": [{"url": "https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties."}, {"lang": "es", "value": "Las contrase\u00f1as administrativas para todas las versiones de Bond JetSelect son almacenadas dentro de un archivo desprotegido en el sistema de archivos, en lugar de cifrarse dentro de la base de datos de MySQL. Esta copia de seguridad de las contrase\u00f1as es realizada como parte del script de instalaci\u00f3n, despu\u00e9s de que el administrador haya generado una contrase\u00f1a usando ENCtool.jar (consulte CVE-2019-13022). Esto permite que cualquier usuario con pocos privilegios que pueda leer este archivo obtenga trivialmente las contrase\u00f1as de las cuentas administrativas de la aplicaci\u00f3n JetSelect. La ruta al archivo que contiene el hash de contrase\u00f1a codificada es /opt/JetSelect/SFC/resources/sfc-general-properties."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetstream:jetselect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B89304F8-EEC0-44DA-9986-66CD144E334A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}