// For flags

CVE-2022-37164

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.

Inoda OnTrack versión v3.4, emplea una política de contraseña débil que permite a atacantes conseguir acceso no autorizado a la aplicación mediante ataques de fuerza bruta. Además, las contraseñas de usuarios son cifradas sin sal ni pimienta, lo que facilita mucho que herramientas como hashcat descifren los hashes

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-08-01 CVE Reserved
  • 2022-09-08 CVE Published
  • 2024-04-29 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
  • CWE-916: Use of Password Hash With Insufficient Computational Effort
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ontrack Project
Search vendor "Ontrack Project"
 Ontrack
Search vendor "Ontrack Project" for product "Ontrack"
 3.4
Search vendor "Ontrack Project" for product "Ontrack" and version "3.4"
-
Affected