CVE-2020-6857

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-6857
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://hyp3rlinx.altervista.org Exploit Third Party Advisory
http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/29 Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/35 Exploit Mailing List Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/30 Exploit Mailing List Third Party Advisory
http://hyp3rlinx.altervista.org Exploit Third Party Advisory
http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/29 Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/35 Exploit Mailing List Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/30 Exploit Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:taskautomation:carbonftp:1.4:*:*:*:*:*:*:*
History

21 Nov 2024, 05:36

Type Values Removed Values Added
References () http://hyp3rlinx.altervista.org - Exploit, Third Party Advisory () http://hyp3rlinx.altervista.org - Exploit, Third Party Advisory
References () http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html - Exploit, Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2020/Jan/29 - Exploit, Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2020/Jan/29 - Exploit, Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2020/Jan/35 - Exploit, Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2020/Jan/35 - Exploit, Mailing List, Third Party Advisory
References () https://seclists.org/bugtraq/2020/Jan/30 - Exploit, Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2020/Jan/30 - Exploit, Mailing List, Third Party Advisory
Information

Published : 2020-01-21 17:15

Updated : 2024-11-21 05:36

NVD link : CVE-2020-6857

Mitre link : CVE-2020-6857

CVE.ORG link : CVE-2020-6857

JSON object : View

Products Affected

taskautomation

  • carbonftp
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-798

Use of Hard-coded Credentials