CVE-2014-2354
0.1%V4
2014-05-30
23h00 +00:00
23h00 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
Cogent DataHub Use of Password Hash With Insufficient Computational Effort
Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.Solusi CVE
Cogent Real-Time Systems, Inc. has produced a new version of the
Cogent DataHub application, Version 7.3.5, that fixes three of the four
identified vulnerabilities. The updated version is available at the
following address:
http://cogentdatahub.com/Download_Software.html
Cogent
has indicated that it will not be fixing the cryptographic weaknesses
of hashed usernames and passwords because of compatibility issues with
existing systems. Cogent and the researcher agree that an effective
mitigation strategy for users is to select sufficiently strong
passwords. Cogent has indicated that password hashes can be checked for
strength using sites such as: https://crackstation.net/ .
Informasi CVE
Kelemahan Terkait
| Nama Kelemahan | Sumber | |
|---|---|---|
| Use of Password Hash With Insufficient Computational Effort The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. |
||
| Category : Credentials Management Errors Weaknesses in this category are related to the management of credentials. |
Metrik
| Metrik | Skor | Tingkat keparahan | CVSS Vektor | Sumber |
|---|---|---|---|---|
| V2 | 6 | AV:L/AC:H/Au:S/C:C/I:C/A:C | ||
| V2 | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N | nvd@nist.gov |
EPSS
EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.
Skor EPSS
Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.
Persentil EPSS
Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.
Produk yang Disebutkan
Konfigurasi 0
Cogentdatahub>>Cogent_datahub >> Version Hingga (termasuk) 7.3.4
Cogentdatahub>>Cogent_datahub >> Version 7.0
Cogentdatahub>>Cogent_datahub >> Version 7.0.2
Cogentdatahub>>Cogent_datahub >> Version 7.1.0
Cogentdatahub>>Cogent_datahub >> Version 7.1.1
Cogentdatahub>>Cogent_datahub >> Version 7.1.1.63
Cogentdatahub>>Cogent_datahub >> Version 7.1.2
Cogentdatahub>>Cogent_datahub >> Version 7.2.2
Cogentdatahub>>Cogent_datahub >> Version 7.3.0
Cogentdatahub>>Cogent_datahub >> Version 7.3.1
Cogentdatahub>>Cogent_datahub >> Version 7.3.2
Cogentdatahub>>Cogent_datahub >> Version 7.3.3
