CVE-2024-1040
Assigner: icscert
Published: 2024-02-01T21:41:08.954Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: WEB-MASTER
vendor: Gessler GmbH
versions: status: affected
version: 7.9
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Felix Eberstaller and Nino Fürthauer of Limes Security reported these vulnerabilities to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device.</span>

</span>


value: 


Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device.




metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-328
description: USE OF WEAK HASH CWE-328
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Gessler GmbH recommends updating EZ2 to 3.2 or greater and WebMaster to 4.4 or greater to mitigate these vulnerabilities. Updates have to be applied by Gessler GmbH technicians. For more information contact </span><a target="_blank" rel="nofollow" href="https://www.gessler.de/en/contact-us/">Gessler GmbH</a><span style="background-color: rgb(255, 255, 255);">.</span>

<br>
value: 
Gessler GmbH recommends updating EZ2 to 3.2 or greater and WebMaster to 4.4 or greater to mitigate these vulnerabilities. Updates have to be applied by Gessler GmbH technicians. For more information contact  Gessler GmbH https://www.gessler.de/en/contact-us/ .



source: discovery: UNKNOWN
title: Use of weak hash in Gessler GmbH WEB-MASTER 
x_generator: engine: Vulnogram 0.1.0-dev