A vulnerability, which was classified as problematic, was found in NCH Express Invoice 7.25. Affected is an unknown functionality of the component Configuration File. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. CVE summarizes:

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

The weakness was disclosed 04/07/2020. This vulnerability is traded as CVE-2020-11560 since 04/05/2020. The attack needs to be approached locally. The successful exploitation needs a authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51540). The entry VDB-152833 is pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• NCH

Name

• Express Invoice

Version

• 7.25

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion