CVE-2017-6528
HighSummary
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to plaintext password storage. The /home/dna/spool/.pfile file contains passwords in plain text.
Risk Assessment
Storing passwords in plaintext exposes the system to unauthorized access risks. Attackers can easily gain access to sensitive information.
Recommendation
It is recommended to implement password encryption mechanisms and review the application's security configuration. The system should also be updated to the latest version to minimize risks.
Other vulnerabilities in dnaTools dnaLIMS 4-2015s13
See all- CVE-2017-6529High
An issue was discovered in dnaTools dnaLIMS version 4-2015s13 related to session hijacking by guessing the UID parameter.
- CVE-2017-6527High
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user.
- CVE-2017-6526Critical
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).
Original NVD description (English source)
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).