CVE-2016-10104

moderate-risk

Published 2017-01-23

Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for SSH/SFTP profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Automize

Affected Vendors

Hiteksoftware

References (4)

http://www.securityfocus.com/bid/96845

Third Party Advisory https://rastamouse.me/guff/2016/automize/

http://www.securityfocus.com/bid/96845

Third Party Advisory https://rastamouse.me/guff/2016/automize/

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 24/34 · High