CVE-2021-42699
Assigner: icscert
Published: 2021-11-05T15:39:16
State: PUBLISHED
affected: product: DAQFactory
vendor: AzeoTech
versions: lessThanOrEqual: New version
status: affected
version: All versions
versionType: custom
descriptions: value: The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
type: CWE
source: discovery: UNKNOWN
title: AzeoTech DAQFactory
workarounds: value: Users are discouraged from using documents from unknown/untrusted sources.
Users are encouraged to store .ctl files in a folder only writeable by admin-level users.
Users are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.
Users are encouraged to apply a document editing password to their documents.
Users should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script.
x_generator: engine: Vulnogram 0.0.9