CVE-2021-42370

A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.)

CVSS v3 7.5 HIGH
CVSS v2.0 4.3 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx	Third Party Advisory
https://lpar2rrd.com/note730.php	Release Notes Vendor Advisory
https://stor2rrd.com/note730.php	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xorux:lpar2rrd::::::::
	cpe:2.3:a:xorux:stor2rrd::::::::

History

No history.

Information

Published : 2021-11-08 05:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-42370

Mitre link : CVE-2021-42370

CVE.ORG link : CVE-2021-42370

JSON object : View

Products Affected

xorux

stor2rrd
lpar2rrd

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2021-42370", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-11-08T05:15:07.713", "references": [{"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lpar2rrd.com/note730.php", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://stor2rrd.com/note730.php", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.)"}, {"lang": "es", "value": "Se presenta una situaci\u00f3n de manejo inapropiado de contrase\u00f1as en XoruX LPAR2RRD y STOR2RRD versiones anteriores a 7.30, porque la informaci\u00f3n en texto sin cifrar est\u00e1 presente en los campos de entrada de contrase\u00f1as HTML en las propiedades del dispositivo. (Una visualizaci\u00f3n de las contrase\u00f1as requiere la configuraci\u00f3n de un navegador web para mostrar los campos de entrada de contrase\u00f1as HTML)"}], "lastModified": "2022-07-29T12:46:02.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xorux:lpar2rrd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18C13897-3921-46AC-BB02-4D5CEB3FF48A", "versionEndExcluding": "7.30", "versionStartIncluding": "7.21"}, {"criteria": "cpe:2.3:a:xorux:stor2rrd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F02B19C0-7243-4034-A064-2BAA032B30EA", "versionEndExcluding": "7.30", "versionStartIncluding": "7.21"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}