PT-2017-14349
CVE-2017-15997
·
تاريخ النشر
2017-10-29
·
تاريخ التحديث
2019-10-03
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
NQ Contacts Backup & Restore version 1.1
Description
The issue concerns the use of a static RC4 key for encryption in the application, which can allow an attacker to more easily gain access to user credentials by accessing the preferences XML file. This affects the security of user passwords stored locally.
Recommendations
For version 1.1, consider disabling the use of RC4 encryption until a more secure encryption method can be implemented, or restrict access to the preferences XML file to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾