A vulnerability classified as problematic has been found in MFScripts YetiShare up to 4.5.4. Affected is an unknown code of the component Hash Handler. The manipulation with an unknown input leads to a weak password hash vulnerability (Expired). CWE is classifying the issue as CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. This is going to have an impact on confidentiality. CVE summarizes:

MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).

The weakness was disclosed 02/10/2020. This vulnerability is traded as CVE-2019-20062 since 12/29/2019. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-149831, VDB-149830 and VDB-149829 are pretty similar.

Productinfo

Vendor

• MFScripts

Name

• YetiShare

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion