CVE-2020-35992

Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/micahvandeusen/PrologueDecrypt	Third Party Advisory
https://www.fiserv.com	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fiserv:prologue:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-23 02:15

Updated : 2024-02-28 19:29

NVD link : CVE-2020-35992

Mitre link : CVE-2020-35992

CVE.ORG link : CVE-2020-35992

JSON object : View

Products Affected

fiserv

prologue

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2020-35992", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-08-23T02:15:07.427", "references": [{"url": "https://github.com/micahvandeusen/PrologueDecrypt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.fiserv.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database."}, {"lang": "es", "value": "Fiserv Prologue versiones hasta 16-12-2020, no protege apropiadamente la contrase\u00f1a de la base de datos. Si un atacante consiguiera acceso al archivo de configuraci\u00f3n (espec\u00edficamente, el atributo LogPassword dentro de appconfig.ini), podr\u00eda descifrar la contrase\u00f1a almacenada dentro del archivo de configuraci\u00f3n. Esto permitir\u00eda obtener credenciales en texto sin cifrar para la base de datos (para acceder a los registros financieros de los clientes almacenados en la base de datos), y en algunos casos permitir\u00eda el inicio de sesi\u00f3n remoto en la base de datos."}], "lastModified": "2022-08-25T20:45:02.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fiserv:prologue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1014D3-6624-4628-901F-B348BE790C3A", "versionEndIncluding": "2020-12-16"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}