CVE-2020-35992

{"id": "CVE-2020-35992", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-08-23T02:15:07.427", "references": [{"url": "https://github.com/micahvandeusen/PrologueDecrypt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.fiserv.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database."}, {"lang": "es", "value": "Fiserv Prologue versiones hasta 16-12-2020, no protege apropiadamente la contrase\u00f1a de la base de datos. Si un atacante consiguiera acceso al archivo de configuraci\u00f3n (espec\u00edficamente, el atributo LogPassword dentro de appconfig.ini), podr\u00eda descifrar la contrase\u00f1a almacenada dentro del archivo de configuraci\u00f3n. Esto permitir\u00eda obtener credenciales en texto sin cifrar para la base de datos (para acceder a los registros financieros de los clientes almacenados en la base de datos), y en algunos casos permitir\u00eda el inicio de sesi\u00f3n remoto en la base de datos."}], "lastModified": "2022-08-25T20:45:02.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fiserv:prologue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1014D3-6624-4628-901F-B348BE790C3A", "versionEndIncluding": "2020-12-16"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}